dev1/notify-laravel

Workflow auditdanger

The release workflow combines a workflow_run trigger, an untrusted checkout, and top-level write permissions, creating a meaningful CI supply-chain exposure; all six action references are also unpinned. The audit completed without additional findings.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months; recent release activity partly offsets this, but the lack of ongoing development lowers maintenance confidence.

Repo popularitycaution

The repository has zero stars, forks, and watchers. This is weak supporting evidence, but the package is only about one year old and popularity alone does not establish poor health.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and maintenance gap.