hei/laravel-scarlett-player

Release historycaution

The package is only hours old, with four releases and a median interval of about 4 hours; this shows active initial work but provides little long-term maintenance evidence.

Repo commit activitycaution

No commits or active maintainers were recorded in the last 3 months, which is concerning for maintenance, although the repository was pushed recently and had three merged pull requests in the last month.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear for a package handling analytics ingestion and media-related routes.

Version stabilitycaution

v0.3.0 is not a stable major release, so its API and behavior may still change substantially despite not being marked as a prerelease.

Workflow auditcaution

Both workflows use read-only permissions and the audit completed fully, but all 26 action references are unpinned. The reported cache-poisoning finding has low confidence, so it is a hygiene concern rather than a severe risk.