leeovery/laravel-idempotency

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. The signal does not show that it is unsafe, but lifecycle execution adds a small supply-chain and installation-review concern.

Release historycaution

This is the package's first release and it is only hours old, so there is no demonstrated release track record yet. The age is too short to treat the absence of later releases as abandonment.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. For a newly published library this is a modest transparency and assurance gap.

Security policycaution

The repository has no security policy. This is not evidence of unsafe code, but it gives maintainers and consumers no documented vulnerability-reporting path.

Workflow auditcaution

The workflow audit completed cleanly with no dangerous triggers, untrusted checkouts, or high-confidence findings, but all four action references are unpinned, weakening build reproducibility.