mirafive/sdk-laravel

Release historycaution

This is the package's first release and it was published today, so there is no release track record yet. Its newness explains the lack of history but still leaves maintenance consistency unproven.

Repo commit activitycaution

There were no commits in the last three months, but the repository is brand new and was pushed shortly before this release. This limits evidence of sustained maintenance rather than showing a demonstrated collapse.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a transparency and hygiene gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented. This is a moderate transparency gap for a package that handles analytics credentials.

Workflow auditcaution

All three workflows were analyzed without audit findings or untrusted-code sinks, but all five action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene concerns, with the write scope being mild on its own.