hosmelq/laravel-pulse-schedule

Project backingcaution

The package and repository are owned by the same individual, so ownership is consistent, though it does not provide organization-level backing.

Release historycaution

The package is over two years old with six releases and one release in the last 12 months; this shows continued publishing but a modest cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign of currently quiet maintenance capacity.

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability reporting and response expectations undocumented for users.

Workflow auditcaution

The only workflow is fully analyzed and has no untrusted checkout or script-injection trigger, but all three action references are unpinned and a high-confidence template-injection finding remains. The workflow uses job-level rather than broad top-level permissions, which partly offsets the concern.