digit-soft/laravel-attachments

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. This weakens evidence of ongoing maintenance despite the recent package release.

Repo popularitycaution

The repository has 0 stars, 1 fork, and 2 watchers. Popularity is only supporting evidence, but these low counts provide little external validation or community support.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling was detected. That is a maintenance and transparency gap for a package handling file uploads.

Security policycaution

The linked repository has no security policy. This leaves vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The single workflow has both uses references unpinned, plus high-confidence template-injection and medium-confidence archived-action findings. No untrusted checkout or script-injection sink was reported, so these are workflow hygiene concerns rather than a severe standalone risk.