padosoft/laravel-iam-agents

Licensecaution

The manifest declares MIT, while the artifact license file is recognized as Apache-2.0; although a license is present, the mismatch creates uncertainty about the terms of this release.

Release historycaution

The package is only 26 days old and has issued 11 releases, with a median interval of about 1 hour 14 minutes. This shows active iteration but leaves little long-term maintenance history.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For an authorization-focused package, that is a modest transparency and maintenance gap.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented for a package handling delegated access.

Workflow auditcaution

Both workflows were analyzed without high-confidence audit findings, but all 3 action references are unpinned and one workflow grants top-level write permissions. These are avoidable supply-chain and permission-hygiene weaknesses, though not severe on their own.