jakub-lipinski/consent-for-laravel

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during installation. This is a supply-chain and install-behavior consideration, but the signal alone does not establish unsafe behavior.

Release historycaution

The package is only 1 day old, despite 12 releases in that period and a median release interval of 0 days. This shows active initial development but provides little evidence of sustained maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a minor transparency gap for a package handling consent and audit data.

Workflow auditcaution

Both workflows use read-only permissions and the audit found no sinks, high-severity findings, or incomplete files. However, all 5 action references are unpinned, reducing build reproducibility.