dot-env-it/laravel-module-boilerplate

Package scaffoldingcaution

A README is present and the package is explicitly a development-only generator; missing packaged tests and a changelog are expected for this kind of boilerplate artifact. The source repository also reports no tests or changelog, which limits validation evidence.

Release historycaution

The package is only 152 days old and both releases arrived within about 5 minutes, leaving little evidence of sustained release practice.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tools are configured, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so users have no documented reporting path or stated security process.

Workflow auditcaution

Both workflows grant top-level write permissions, and all 3 analyzed action references are unpinned. The audit found no untrusted checkout, script injection, or other high-confidence dangerous workflow finding, so this is a hygiene concern rather than a severe risk.