jack-cc-kasa/fcm-notification-channel

Release historycaution

The package is only 42 days old with two releases published within a short interval, so there is too little history to demonstrate sustained maintenance.

Repo bus factorcaution

Only one contributor made all four commits in the last three months, leaving maintenance dependent on a single person.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools are reported, leaving an avoidable gap in project hygiene.

Security policycaution

The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities in a notification integration package.

Workflow auditcaution

The sole workflow has no untrusted checkout or injection findings and the audit completed successfully, but all three action references are unpinned, weakening build reproducibility.