laravel-json-api/core

Name lookalikecaution

The detector reports a lookalike relationship to laravel/octane and says the package borrows that identity, but artifact overlap is 0 and the README does not identify it as that package; this looks more like a naming-hygiene concern than evidence of a copied package.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The latest release and push occurred on the same recent date, which partly offsets but does not eliminate the quiet commit window.

Repo toolingcaution

Composer is used for the build, but no security-scanning tool was detected, leaving a modest transparency and maintenance-hygiene gap.

Security policycaution

The linked repository has no security policy, so there is no documented channel or process for reporting vulnerabilities.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or high-severity findings. However, all three action references are unpinned, which weakens build reproducibility.