christhompsontldr/laravel-docit

Release historycaution

This is the package's only release, published about 182 days ago, so there is little release history to demonstrate sustained maintenance. The available release notes provide some transparency but do not offset the limited track record.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured after the release. For a package only about six months old, that leaves meaningful uncertainty about ongoing maintenance.

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tooling was detected. This is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no security policy, leaving no documented route for reporting vulnerabilities or describing security handling.

Workflow auditcaution

Both workflows scope permissions at the job level, but all six action references are unpinned, weakening build reproducibility. The audit also found three high-confidence template-injection findings; template injection alone is workflow hygiene rather than a severe health verdict.