oi-lab/oi-laravel-notes

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time lifecycle script. The signal does not show harmful behavior, but any install-time execution adds a small supply-chain review concern.

Repo bus factorcaution

One contributor made all 4 commits in the last 3 months, creating a concentrated maintenance dependency. The organization-owned repository provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. This is a transparency and maintenance gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy. For a Laravel library handling notes, users, and attachments, that weakens the documented process for reporting and handling vulnerabilities.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but both referenced actions are unpinned. The missing top-level permissions block is acceptable on its own; unpinned actions remain a minor reproducibility and supply-chain hygiene gap.