jeffersongoncalves/laravel-webhook-signatures

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is not inherently unsafe, but it adds installation behavior that should be understood before adoption.

Release historycaution

The package is only 86 days old and has two releases, both published within minutes on the first day, so long-term maintenance is not yet demonstrated.

Repo popularitycaution

The repository has one star and no forks, so there is little external adoption evidence. For a young, focused package this is supporting evidence only, not a health verdict.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest gap in repository transparency and ongoing checks.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and disclosure expectations less clear for a package handling webhook signatures.