kazistm/laravel-scoped-backup

Project backingcaution

The repository is owned by a user account rather than an organization, so the project has no visible organizational backing. This is a modest capacity concern, especially alongside the package's very short history.

Release historycaution

The package is effectively brand new: it has only two releases, both published within about 26 minutes, so there is little evidence of sustained maintenance or release reliability.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the previous three months. Because the project is newly published, this is consistent with its age but still provides no evidence of established maintenance.

Version stabilitycaution

v0.0.2 is not a stable major release, which signals an immature API and a higher likelihood of breaking changes despite the release not being marked as a prerelease.

Workflow auditcaution

All five workflows were analyzed, but the audit found an untrusted checkout in a workflow_run workflow, top-level write permissions in two workflows, all nine action references unpinned, and a high-confidence adhoc package installation. These are meaningful workflow hygiene and supply-chain concerns, though none was rated high severity.