telegram-bot-essentials/gateway-admin

Lifecycle scriptscaution

A post-autoload-dump script runs during installation, creating some execution-time supply-chain exposure even though this is a common Composer lifecycle hook.

Release historycaution

The package is only 14 days old but already has five releases, with a median interval of about 2 days; this shows active development but limited maturity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest security-process gap.

Version stabilitycaution

Version v0.0.5 is not a stable major release, so compatibility expectations remain limited despite the release not being marked as a prerelease.

Workflow auditcaution

All four workflows were analyzed successfully with no audit findings or untrusted checkout/script-injection sinks. However, all four action references are unpinned and one workflow grants top-level write permission, creating a workflow hygiene caution.