hubertalva/laravel-vermicelli-starter-kit

Lifecycle scriptscaution

Four install and update lifecycle scripts run package commands, increasing installation complexity and execution surface. This is a caution for supply-chain transparency, although lifecycle scripts can be normal for a Laravel starter kit.

Repo popularitycaution

The repository has one star and no forks or watchers, so there is little public adoption evidence. Popularity is only supporting evidence, and the active release and commit signals are stronger.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tools were detected. This leaves a security-process gap, though the absence of scanning alone does not establish abandonment or unsafe code.

Security policycaution

No security policy was found in the repository, reducing transparency about vulnerability reporting and maintenance response.

Token permissionscaution

One of the two workflows lacks top-level token permissions, while the other declares read-only permissions and neither workflow requests top-level write access. This is a minor workflow-hygiene gap rather than a severe risk.