rockero-cz/laravel-starter-kit

Lifecycle scriptscaution

The package runs a post-install Composer lifecycle script. This is a meaningful installation-time behavior that should be reviewed, though it is not by itself evidence that the package is unsafe.

Release historycaution

The package has 24 releases over roughly three years, but none in the last 12 months; the latest release was published on October 7, 2024. This indicates a sustained maintenance pause.

Repo toolingcaution

The repository uses Composer build tooling but reports no security scanning tools. The missing scanning is a hygiene gap, while the build tooling itself is appropriate.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All four workflows were analyzed without high-severity findings or untrusted checkouts, but all 11 action references are unpinned. Unpinned actions weaken reproducibility and supply-chain integrity even though no dangerous trigger or sink was found.