padosoft/laravel-invitations

Release historycaution

This is a young package, released four times over about 86 days with releases roughly every 10 days, showing active early maintenance but limited long-term history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving security-process coverage weaker than the rest of the project tooling.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent for a package handling invitations and anti-abuse features.

Workflow auditcaution

All three workflows were analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings, and two use read-only permissions. However, all eight action references are unpinned, weakening build reproducibility.