devpulse/laravel

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single active developer. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

The repository had four commits in the last three months, showing recent activity, but the volume is modest for a package with active releases.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a repository-security hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The workflow audit completed cleanly with no dangerous triggers, untrusted checkouts, or audit findings, and it does not grant top-level write permissions. However, all four referenced actions are unpinned, which weakens build reproducibility and action supply-chain hygiene.