devlab-studio/laravel-mailer

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, adding a small amount of installation complexity and execution risk.

Repo popularitycaution

The repository has one star and no forks or watchers. This is limited supporting evidence, but popularity is not required for a small, actively maintained package.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no published security policy, reducing clarity about how vulnerabilities should be reported and handled.

Workflow auditcaution

Both workflows were analyzed with no audit findings or untrusted checkouts, but all five action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene concerns rather than severe risks in the absence of an untrusted trigger or sink.