specdocular/laravel-openapi

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This is common in Composer packages but means installation performs package-defined automation that should be reviewed before use.

Repo bus factorcaution

All 12 recent commits came from one contributor, giving the project a fragile maintenance base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo popularitycaution

The repository has zero stars, forks, and watchers, so there is little evidence of external use or community validation. The package is relatively young, making this a supporting concern rather than a standalone adoption blocker.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The build setup is adequate, while the lack of automated security checks reduces transparency somewhat.

Token permissionscaution

One workflow declares read-only permissions and none declares top-level write access; the remaining workflow lacks top-level permissions, leaving a minor least-privilege gap but no observed write permission.