mscode-pl/laravel-react-email

Lifecycle scriptscaution

The post-autoload-dump script adds install-time behavior, which deserves awareness for a Composer dependency, but this is a common package integration hook and is not severe on its own.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance may have slowed for this young package.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools are configured, leaving a transparency and maintenance gap.

Security policycaution

The repository has no security policy, making vulnerability-reporting expectations less clear for consumers.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers or audit findings, but all four action references are unpinned and the workflow has no top-level permissions block; these are workflow hygiene weaknesses rather than severe risks.