georgeboot/laravel-echo-api-gateway

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tool was detected. This is a transparency and hygiene gap, not evidence of unsafe code.

Security policycaution

The repository has no security policy. For a package handling websocket authentication and channel security, the absence reduces vulnerability-reporting transparency.

Workflow auditcaution

Both workflows were analyzed successfully, with no untrusted checkouts or script injections, but all 13 action references are unpinned and the release workflow has top-level write permissions. The only audit finding was low-confidence cache-poisoning, so it is hygiene rather than a severe risk.