coderflexx/laravel-sendy

Release historycaution

The package is about 502 days old with three releases and a median interval of about 219 days, indicating a relatively slow release cadence. A release within the assessed period provides some evidence of ongoing maintenance, but the history is still limited.

Repo bus factorcaution

One contributor made 100% of the three recent commits. Organization ownership offers some handoff capacity, but no second active contributor is shown to demonstrate that capacity in practice.

Repo commit activitycaution

There were three commits in the last three months, showing some recent activity, but all were made by one active maintainer. That is a thin maintenance base and raises continuity concerns.

Security policycaution

The repository has no security policy. This is a modest transparency gap for a package that makes HTTP API requests, though it is not evidence of abandonment or unsafe behavior by itself.

Workflow auditcaution

The audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow and all 12 analyzed action references are unpinned. The pull_request_target workflow has no untrusted checkout or script-injection finding, so these are workflow-hygiene concerns rather than a severe standalone risk.