gocpa/sendsay-laravel-mailer

Workflow auditdanger

All 12 action references are unpinned, and three workflows grant top-level write permissions. A high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.

Lifecycle scriptscaution

A post-autoload-dump install script runs during Composer installation. This is a mild supply-chain and installation-complexity concern, though the signal does not show that the script is unsafe.

Maintainerscaution

Only one registry publishing account is listed, which is a thin publishing base; the organization-owned repository provides some compensation, so this is not a severe concern.

Release historycaution

The latest registry release was over two years ago, with no releases in the last 12 months. This materially raises abandonment and compatibility risk for a Laravel integration.

Repo commit activitycaution

No commits and no active maintainers were observed in the last three months. This conflicts somewhat with the recent repository push and still leaves current development momentum unclear.