Registro públicoDébil
Informe de salud del softwareesquema 0.30.0 · métricas 2.5.0 · 2026-08-03 11:30 UTC
pushery / email-magic-link-for-laravel
Passwordless email magic-link & OTP authentication for Laravel — standalone or with a correct, no-bypass Fortify 2FA handoff and scanner-safe link consumption.
pushery/email-magic-link-for-laravel tiene un índice de salud de 41 sobre 100, lo que lo sitúa en la banda Débil. Su puntuación más alta es Vitality (72/100) y la más baja, Engineering Quality (21/100). Se actualizó por última vez hoy. Una sola persona concentra la mayor parte del trabajo reciente.
41
global / 100Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala estandarizada de 1 a 100. El resultado global parte de su media ponderada, calibrada contra la distribución del registro público para que las bandas tengan significado percentil; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe un límite «En riesgo» de 34.
41
Excepcional93-100El nivel más alto del registro (≈ el 5% superior); cumple prácticamente todos los criterios evaluados
Excelente80-92Sólido en todos los frentes; carencias menores
Bueno65-79Saludable; carencias limitadas y manejables
Moderado50-64Aceptable con carencias notables; se recomienda revisión
Débil35-49Debilidades sustanciales en varias áreas
En riesgo20-34Debilidades significativas; su adopción exige cautela
Crítico1-19Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
El resultado global ponderado 44 se calibra a 41 en la escala publicada del índice (calibración del registro 2026-08-02).
Titularidad
PUSHERYCuenta personal
5 seguidores7 repositorios públicosdesde mar 2026
Este repositorio pertenece a una cuenta personal. Un proyecto con un único propietario conlleva más riesgo de continuidad que uno respaldado por una organización.
Ecosistemas de paquetes
| Registro | Paquete | Versión | Descargas / mes | Versiones | Última publicación | Etiquetas |
|---|---|---|---|---|---|---|
| Packagist | pushery/email-magic-link-for-laravel | v0.20.0 | 3091 | 28 | hace 0 días | authenticationloginlaravelotp2fapasswordlessfortifymagic-link |
Métricas por categoría
Vitalidad
¿Está vivo el proyecto: se escribe código y se publican versiones?
72
Actividad de desarrollo
53Moderado
Cómo se puntúa
| 36/36 | Recencia de push — último push hace 0 días |
| 3.5/36 | Cadencia de commits — 5/52 semanas con commits |
| 13.3/18 | Volumen de commits — 29 commits en el último año |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Datos de entrada utilizados
| commits_last_year | 29 |
| human_commit_share | 1 |
| days_since_last_push | 0 |
| active_weeks_last_year | 5 |
Disciplina de publicación
100Excepcional
Cómo se puntúa
| 27/27 | Publica versiones — 28 versiones publicadas |
| 36/36 | Recencia de las versiones — última versión hace 0 días |
| 27/27 | Cadencia de publicación — una versión cada ~3,9 días |
| 0/10 | OpenSSF Scorecard: Signed-Releases — sin datos |
Datos de entrada utilizados
| releases_count | 28 |
| latest_release_tag | v0.20.0 |
| releases_from_tags | no |
| days_since_latest_release | 0 |
| mean_days_between_releases | 3,9 |
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: Signed-Releases. Los pesos restantes se han renormalizado.
Comunidad y Adopción
¿Tiene el proyecto usuarios, descargas, atención y unas condiciones acogedoras para quienes contribuyen?
46
Popularidad y adopción
26En riesgo
Cómo se puntúa
| 25.8/60 | Estrellas — 40 estrellas |
| 0/25 | Forks — 1 forks |
| 0/15 | Observadores — 0 observadores |
Datos de entrada utilizados
| forks | 1 |
| stars | 40 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Salud de la comunidad
70Bueno
Cómo se puntúa
| 22.5/22.5 | README |
| 22.5/22.5 | Licencia — licencia reconocida (MIT) |
| 18/18 | Guía CONTRIBUTING |
| 0/13.5 | Código de conducta |
| 0/7.2 | Plantilla de issues |
| 0/6.3 | Plantilla de PR |
Datos de entrada utilizados
| has_readme | sí |
| has_license | sí |
| readme_badges | 5 |
| has_contributing | sí |
| has_issue_template | no |
| has_code_of_conduct | no |
| readme_badge_services | shields.io |
| has_pull_request_template | no |
Cómo se puntúa
| 46.5/80 | Descargas mensuales — 3091 descargas/mes en packagist |
| 0/20 | Dependientes en el registro — 0 paquetes dependen de él |
Datos de entrada utilizados
| packages | pushery/email-magic-link-for-laravel |
| dependents | 0 |
| ecosystems | packagist |
| total_downloads | 3273 |
| monthly_downloads | 3091 |
Sostenibilidad y Gobernanza
¿Sobrevivirá el proyecto a sus personas: factor bus, capacidad de respuesta, quién lo respalda y mantenimiento del paquete?
47
Cómo se puntúa
| 9/54 | Factor bus — la mitad de los commits recae en 1 contribuyente(s) |
| 0/22.5 | Distribución de commits — el principal contribuyente firma el 100% de los commits |
| 1.4/13.5 | Amplitud de contribuyentes — 1 contribuyentes |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Datos de entrada utilizados
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Cómo se puntúa
| 0/42 | Resolución de issues — sin issues o sin datos |
| 30/30 | Aceptación de PR — 28/28 PR decididos fusionados |
| 0/13 | Newcomer PR acceptance — ningún PR de un contribuyente primerizo decidido en 30 d |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Datos de entrada utilizados
| merged_prs | 28 |
| open_issues | 0 |
| closed_issues | 0 |
| prs_merged_7d | 1 |
| prs_decided_7d | 1 |
| prs_merged_30d | 8 |
| prs_decided_30d | 8 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
| first_time_authors_30d | 0 |
| first_time_prs_merged_30d | 0 |
| first_time_prs_decided_30d | 0 |
Excluidos de la puntuación (sin datos o no aplicable): Resolución de issues, newcomer_pr_acceptance. Los pesos restantes se han renormalizado.
Propiedad y custodia
29En riesgo
Cómo se puntúa
| 10/30 | Respaldo de la propiedad — cuenta personal (usuario) |
| 0/20 | Dominio verificado — no aplicable a cuentas de usuario |
| 5.6/25 | Alcance del propietario — 5 seguidores de pushery |
| 7.3/25 | Trayectoria — 7 repos públicos, cuenta de ~0 años |
Datos de entrada utilizados
| followers | 5 |
| owner_type | User |
| is_verified | — |
| owner_login | pushery |
| public_repos | 7 |
| account_age_days | 125 |
Excluidos de la puntuación (sin datos o no aplicable): Dominio verificado. Los pesos restantes se han renormalizado.
Mantenimiento de paquetes
100Excepcional
Cómo se puntúa
| 25/25 | Publicado y resoluble — 1 paquete(s) en packagist |
| 35/35 | Recencia de publicación — última publicación hace 0 días |
| 20/20 | Historial de versiones — 28 versiones en el registro |
| 20/20 | No obsoleto — activo, ni obsoleto ni retirado |
Datos de entrada utilizados
| packages | pushery/email-magic-link-for-laravel |
| ecosystems | packagist |
| any_deprecated | no |
| min_days_since_publish | 0 |
Calidad de Ingeniería
¿Existen unas prácticas mínimas de ingeniería y documentación?
21
Prácticas de ingeniería
1Crítico
Cómo se puntúa
| 0/24 | Flujos de trabajo de CI |
| 0/24 | Pruebas presentes |
| 0/16 | Configuración de linter |
| 0/9.6 | Hooks de pre-commit |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 28 merged PRs checked by a CI test -- score normalized to 0 |
Datos de entrada utilizados
| has_ci | no |
| has_tests | no |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Documentación
50Moderado
Cómo se puntúa
| 30/30 | README |
| 0/25 | Directorio de documentación |
| 0/15 | Sitio de documentación / página del proyecto |
| 10/10 | Descripción del repositorio |
| 10/10 | Topics — 8 topics |
| 0/10 | Wiki |
Datos de entrada utilizados
| topics | email, laravel, laravel-framework, laravel-package, mail, passwordless, passwordless-authentication, passwordless-login |
| has_wiki | no |
| homepage | — |
| has_readme | sí |
| has_docs_dir | no |
| has_description | sí |
Seguridad
¿Son sólidas las prácticas visibles de seguridad y de cadena de suministro, sin exposición jurisdiccional de alto riesgo sin resolver?
32
Postura de seguridad
32En riesgo
Cómo se puntúa
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 0 out of 28 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 0/10 | Dangerous-Workflow — sin datos |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Licencia — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 0/5 | Packaging — sin datos |
| 0/5 | Pinned-Dependencies — sin datos |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — sin datos |
| 0/7.5 | Token-Permissions — sin datos |
| 7.5/7.5 | Vulnerabilities — 0 existing vulnerabilities detected |
Datos de entrada utilizados
| source | openssf_scorecard |
| checks_evaluated | 13 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 5 |
| scorecard_aggregate | 3,2 |
Excluidos de la puntuación (sin datos o no aplicable): dangerous_workflow, packaging, pinned_dependencies, signed_releases, token_permissions. Los pesos restantes se han renormalizado.
Preparación para IA
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Tiene un peso deliberadamente pequeño (4%): las herramientas para agentes son una señal real de mantenimiento, pero un repositorio sin ninguna puede alcanzar igualmente 100/100.
24
Contexto y guía para agentes
40Débil
Cómo se puntúa
| 0/45 | Instrucciones para agentes — sin CLAUDE.md / AGENTS.md / reglas de editor |
| 0/15 | Documentación legible por máquinas (llms.txt) |
| 40/40 | Historial de commits legible — 28 de 30 commits humanos declaran su intención (asunto estructurado o cuerpo explicativo) |
Datos de entrada utilizados
| has_llms_txt | no |
| legible_history_share | 0,933 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Cómo se puntúa
| 0/18 | Arranque con un solo comando |
| 0/22 | Pruebas automatizadas |
| 0/11 | Configuración de lint / formato |
| 0/11 | Verificación estática de tipos |
| 0/10 | Entorno reproducible |
| 0/10 | Práctica demostrada con agentes — ningún commit con autoría de agente entre los últimos 30 |
| 0/8 | Mantenimiento automatizado — no se observan actualizaciones automáticas de dependencias |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — sin datos |
Datos de entrada utilizados
| has_nix | no |
| has_tests | no |
| lockfiles | — |
| has_dockerfile | no |
| typed_language | no |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: Pinned-Dependencies. Los pesos restantes se han renormalizado.
Legibilidad del código para modelos
55Moderado
Cómo se puntúa
| 0/45 | Código verificable por tipos — PHP sin configuración de verificación de tipos |
| 55/55 | Tamaños de archivo manejables — 0/85 archivos fuente de más de 60 KB |
Datos de entrada utilizados
| primary_language | PHP |
| largest_source_bytes | 16.902 |
| source_files_sampled | 85 |
| oversized_source_files | 0 |
Datos clave
40estrellas de GitHub
1contribuidores
29commits en los últimos 12 meses
0días desde el último push
28versiones publicadas
1factor bus
0issues abiertas
Packagistecosistemas de paquetes
Advertencias de recopilación de datos
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Más detalle
OpenSSF Scorecard 3.2 / 10
3.2agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 0 | CI-Tests | 0 out of 28 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| n/d | Dangerous-Workflow | no workflows found |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| n/d | Packaging | packaging workflow not detected |
| n/d | Pinned-Dependencies | no dependencies found |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 10 | Security-Policy | security policy file detected |
| n/d | Signed-Releases | no releases found |
| n/d | Token-Permissions | No tokens found |
| 10 | Vulnerabilities | 0 existing vulnerabilities detected |
Dependencias directas 1
| Registro | Paquete | Restricción de versión | Manifiesto |
|---|---|---|---|
| Packagist | laravel/framework | ^13.0 | composer.json |
Todas las dependencias no recopilado
No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [
"email",
"laravel",
"laravel-framework",
"laravel-package",
"mail",
"passwordless",
"passwordless-authentication",
"passwordless-login"
],
"is_fork": false,
"size_kb": 869,
"has_wiki": false,
"homepage": null,
"languages": {
"PHP": 178527,
"Blade": 22273
},
"pushed_at": "2026-08-03T11:27:05Z",
"created_at": "2026-06-22T13:03:45Z",
"owner_type": "User",
"updated_at": "2026-08-03T11:28:39Z",
"description": "Passwordless email magic-link & OTP authentication for Laravel — standalone or with a correct, no-bypass Fortify 2FA handoff and scanner-safe link consumption.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "PHP",
"significant_languages": [
"PHP",
"Blade"
]
},
"owner": {
"blog": null,
"name": "PUSHERY",
"type": "User",
"login": "pushery",
"company": null,
"location": "Berlin, Europe",
"followers": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/272318911?v=4",
"created_at": "2026-03-30T19:41:02Z",
"is_verified": null,
"public_repos": 7,
"account_age_days": 125
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.20.0",
"kind": "minor",
"published_at": "2026-08-03T11:27:06Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2026-07-27T00:57:01Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2026-07-25T22:42:54Z"
},
{
"tag": "v0.17.1",
"kind": "patch",
"published_at": "2026-07-11T23:23:07Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2026-07-11T20:34:55Z"
},
{
"tag": "v0.16.1",
"kind": "patch",
"published_at": "2026-07-11T11:32:15Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2026-07-07T18:42:52Z"
},
{
"tag": "v0.15.2",
"kind": "patch",
"published_at": "2026-07-05T17:40:01Z"
},
{
"tag": "v0.15.1",
"kind": "patch",
"published_at": "2026-07-03T22:19:07Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2026-06-29T15:36:03Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-06-25T19:40:14Z"
},
{
"tag": "v0.13.3",
"kind": "patch",
"published_at": "2026-06-23T07:49:12Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2026-06-23T07:31:30Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2026-06-23T06:51:26Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2026-06-22T21:44:40Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2026-06-22T20:56:36Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2026-06-22T20:46:12Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2026-06-22T20:35:50Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-06-22T20:26:29Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-06-22T20:07:44Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-06-22T18:42:40Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-06-22T18:24:02Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-06-22T17:17:50Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-06-22T15:28:27Z"
},
{
"tag": "v0.3.1",
"kind": "patch",
"published_at": "2026-06-22T14:47:11Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-22T14:29:26Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-06-22T14:05:24Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-06-22T13:33:13Z"
}
],
"recent_commits": [
{
"oid": "3027c5b517215eb3c08ace69939a32c42f2e41f1",
"body": "### Fixed\n\n- **The CSP nonce is found again.** `AutoScriptNonce` looked for a global `csp_nonce()`\n function. That function was introduced in spatie/laravel-csp 2.10.3 and does not exist in\n **any** 3.x release — every 3.x version publishes `autoload.psr-4` and no `autoload.files`,\n so it cannot \n[…]\nomposer.json` gains a `test:evals` script and drops the finite `process-timeout` in\n favour of `0`. Both are development-side only; no runtime dependency, autoload entry or\n published default moved.",
"is_bot": false,
"headline": "release: v0.20.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-08-03T11:27:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "17b5226ef89b1e23d3f261928ef57c159b6e9700",
"body": "### Added\n\n- **`php artisan email-magic-link:doctor`** — compares your published config against the one the\n installed version ships and names every key your file does not mention. Publishing the config\n freezes it at that version; the package still merges its own defaults underneath, so everythin\n[…]\ncannot grant `'unsafe-eval'` should set `ui.mode` to `blade`.\n\n Comment-only: no key was added, moved or renamed, so a published config keeps working and\n `email-magic-link:doctor` reports no drift.",
"is_bot": false,
"headline": "release: v0.19.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-27T00:56:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0fb1e78899aca86aae2b48fb1a5a4746fecb2bc1",
"body": "### Added\n\n- A bundled **Laravel Boost skill** (`resources/boost/skills/email-magic-link-for-laravel/SKILL.md`).\n Boost surfaces it inside consuming applications, so an agent integrating the package works from\n the package's own adoption guidance — the routes, the config keys that shape an integra\n[…]\nor pointing at the package's routes file rather\n than at the host's configuration. Both are now resolved through the package's own typed config\n accessor, which falls back to the documented default.",
"is_bot": false,
"headline": "release: v0.18.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-25T22:42:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "413556bfc2816506b824e600225f01aed862a5f2",
"body": "### Added\n\n- A README recipe for **authorizing a gated resource without login** — a one-time\n file download or gated view. Mint a single-use token with the Mint-API /\n `TokenStore` and consume it on your own route with `claimLink()`; a successful\n claim authorizes serving the resource without creating a session. No new\n channel, no serialized payload — it reuses the existing single-use,\n hashed-at-rest token model.",
"is_bot": false,
"headline": "release: v0.17.1",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-11T23:23:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "236406302a7528ab1c1021fdc77aab2d670feb3e",
"body": "### Added\n\n- **Per-link base-URL override.** `issueLink($user, baseUrl: 'https://tenant-a.example.com')`\n builds the confirmation link for another host — useful for multi-domain or\n multi-tenant apps. The signature is computed over the final host, so the link\n verifies only when visited there and\n[…]\nkeeps the response generic and identical for an\n unknown versus an expired token, so the flow stays enumeration-resistant, and\n the JSON error code is configurable via `invalid_response.error_code`.",
"is_bot": false,
"headline": "release: v0.17.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-11T20:34:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6a27ed3229de968d98fcb57280d7eba1299fbaeb",
"body": "### Fixed\n\n- The PHP version badge in the README renders again. It relied on the\n `packagist/php-v` shields.io route, which currently returns empty for every\n package (a broken upstream endpoint, not specific to this package); it now reads\n the supported PHP version from the package's own requirement via the\n `packagist/dependency-v` route.",
"is_bot": false,
"headline": "release: v0.16.1",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-11T11:32:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8cf35f354a9e08401430d2f16a382a9a7520c8f2",
"body": "### Added\n\n- A **resend guard** that layers an escalating cooldown plus a rolling cap on top\n of the existing per-minute limiters, so a repeatedly clicked \"send again\" can no\n longer flood an inbox. After each send the next one for that email is held back a\n little longer (30s → 60s → 120s …, up \n[…]\ns own mail-sending endpoints\n (a \"resend code\" button on a custom challenge, a re-invite, a reset resend). It\n needs a cache store that supports atomic locks and fails closed on one that does\n not.",
"is_bot": false,
"headline": "release: v0.16.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-07T18:42:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0bdf9b2e52146228a5ca6758b39cbfd283650d96",
"body": "### Added\n\n- The token-claim path is now tested against **MySQL 8.4** — the database engine\n Laravel Cloud runs (alongside PostgreSQL) — so the package is proven to work on\n Laravel Cloud out of the box. The atomic single-use link claim and the\n one-time-code lockout are now exercised under real InnoDB row locking, closing\n the gap that in-memory SQLite (whose row locking is a no-op) could not cover.",
"is_bot": false,
"headline": "release: v0.15.2",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-05T17:39:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c87c62fc7eebc9b494769ec9d5fc756490b587e3",
"body": "### Changed\n\n- Documentation and the `email-magic-link:install` command now spell out the two\n setup steps that are easy to miss: running `php artisan migrate` to create the\n token table, and keeping a queue worker running (or using the `sync` queue\n connection locally) because the magic-link email is dispatched to the queue.",
"is_bot": false,
"headline": "release: v0.15.1",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-07-03T22:19:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d876cc70f340d421133c6a57a5d9dede81384ced",
"body": "### Fixed\n\n- The WireKit sign-in screens rendered unstyled. The layout never injected\n WireKit's `@wirekitStyles`, so none of its design tokens (`--color-wk-*`,\n `--padding-wk-*`, …) were defined and every component fell back to a\n transparent, padding-less default. The layout now injects `@wirek\n[…]\nk>` into the WireKit\n layout, for hosts that ship a pre-compiled stylesheet instead of (or alongside)\n a Vite build. `ui.vite` now also accepts `false` to skip `@vite` entirely on a\n non-Vite host.",
"is_bot": false,
"headline": "release: v0.15.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-29T15:36:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e557739afd3fc5486d88a680d83e71b6bc668314",
"body": "### Added\n\n- Bundle the regional locale variants `en-GB`, `en-US`, `pt-PT`, and `pt-BR` (copies of the\n `en`/`pt` messages, ready for regional refinement), so apps that distinguish them get fully\n localized magic-link screens and emails with no fallback. `nl` and the existing locales are\n unchang\n[…]\nes the user through the target guard's provider and\n fails closed (`UserNotInGuardException`, `UnknownGuardException`,\n `MagicLinkDisabledException`) rather than minting a dead or misdirected token.",
"is_bot": false,
"headline": "release: v0.14.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-25T19:40:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "123168a4a3f7c0a84d1af1f99c2ebfe555e68da3",
"body": "### Changed\n\n- The Composer dist is now lean: a shipped `.gitattributes` marks the marketing\n banner (`art/`), repository metadata (`.github/`, `CHANGELOG.md`,\n `CONTRIBUTING.md`), and itself as `export-ignore`, so the installed package\n carries only the runtime code, config, views, translations, and license.",
"is_bot": false,
"headline": "release: v0.13.3",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-23T07:49:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "112491f5f694587734745d77b6587bb98727183a",
"body": "### Added\n\n- GitHub issue templates (bug report and feature request forms, plus a chooser\n config that routes security reports to private disclosure). Repository metadata\n only; the installed package and its API are unchanged.",
"is_bot": false,
"headline": "release: v0.13.2",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-23T07:31:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b5b20e124b995331adb99c353e77b1cc9b1bb97",
"body": "### Added\n\n- A header banner and a short \"Built by Pushery\" section in the README. The\n banner ships in a new `art/` directory; the package API is unchanged.",
"is_bot": false,
"headline": "release: v0.13.1",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-23T06:51:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bb9a1460324c06af3848107c6566146db166301",
"body": null,
"is_bot": false,
"headline": "Update issue templates",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-23T06:21:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fa3f595a060de6b198faae873e410a636362ba7d",
"body": "### Fixed\n\n- The status, invalid-or-expired, and challenge-failed response messages were\n hardcoded in English and ignored the active locale. They now run through the\n translator like the rest of the package, with translations in all seven bundled\n locales (en/de/es/fr/it/nl/pt). A new guard test fails the build if any controller\n response reintroduces a hardcoded user-facing string instead of using the\n translator, so this gap cannot recur.",
"is_bot": false,
"headline": "release: v0.13.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T21:44:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ef6d1cfc6107608f6791820bc186241a221cf34",
"body": "### Added\n\n- Per-channel token lifetimes. The new `link_ttl` and `code_ttl` config keys give\n links and codes their own expiry — for example a shorter, hand-typed code — while\n `ttl` remains the default both inherit when an override is unset or non-positive.\n The notification's \"expires in N minutes\" line and the link's signed-route expiry\n follow the channel's lifetime.",
"is_bot": false,
"headline": "release: v0.12.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T20:56:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "558df6f83de0aa13d62abd44d2344a109954fd96",
"body": "### Added\n\n- A `CaptchaGuard` extension point. Point the new `captcha` config at a class\n implementing `EmailMagicLink\\Contracts\\CaptchaGuard` to verify a CAPTCHA\n (hCaptcha, Turnstile, reCAPTCHA) or any pre-issue challenge before a link or code\n is issued. It runs before the user lookup, so a failed challenge rejects the\n request identically whether or not the account exists, and returns a\n `captcha_failed` error (JSON) or a form error. The default applies no challenge.",
"is_bot": false,
"headline": "release: v0.11.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T20:46:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e67403262513b317b66443b1aae1f889b9055380",
"body": "### Added\n\n- A stable JSON error envelope for the API variant: failed consumptions now return\n `{ \"message\": …, \"error\": \"invalid_or_expired\" }`, a machine-readable code a SPA\n or mobile client can branch on without parsing the human message.\n- The two-factor hand-off now answers an API client wit\n[…]\n knows it must complete the challenge and where to go.\n\n### Changed\n\n- Documented the full JSON token-exchange contract (success, two-factor, error,\n validation, and rate-limit shapes) in the README.",
"is_bot": false,
"headline": "release: v0.10.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T20:35:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fec1b94ba97dc0b38ec8c5db7372bbb9651e90a3",
"body": "### Added\n\n- `MagicLinkAuthenticated($user, $guard, $request)` event, fired the moment a user\n is actually logged in (never for a two-factor hand-off) — the precise signal for\n an audit log, carrying the guard.\n- `MagicLinkConsumptionFailed($reason, $request)` event, fired on every failed\n consum\n[…]\nistinguishes a stale or unknown token from a\n wrong code or a brute-force `LockedOut`, so a host can log all failures and alert\n on lockouts without the user-facing response ever leaking the reason.",
"is_bot": false,
"headline": "release: v0.9.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T20:26:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a933e707e3c567c2da6620eea7eaa805d51b8895",
"body": "### Added\n\n- Multi-guard sign-in. A request may select a guard (from the new `guards`\n allowlist) via a `guard` field; the token is issued for that guard, the user is\n resolved through its provider, and login completes on it. Unknown guards fall\n back to the default. The link and code flows are both guard-aware.\n\n### Changed\n\n- The `MagicLinkAuthenticator::authenticate()` contract gains a `string $guard`\n argument (before `$remember`). Custom authenticators must add the parameter.",
"is_bot": false,
"headline": "release: v0.8.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T20:07:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7be86027d22b0d95af02873420b870dbdf4ba951",
"body": "### Added\n\n- The post-login redirect now returns the user to the URL they originally requested\n (the protected route that triggered the flow), falling back to `redirect_to`. It\n applies to both the browser redirect and the API response, and can be turned off\n with the new `routes.intended` config.\n\n### Changed\n\n- The API response `redirect` field is now the resolved absolute destination URL\n (the intended URL when present, otherwise `redirect_to`).",
"is_bot": false,
"headline": "release: v0.7.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T18:42:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a44db886b278ebfd14a8d2d3b26fa1ff89b88d82",
"body": "### Added\n\n- Bundled Italian, Dutch, and Portuguese translations, bringing the built-in locales\n to English, German, Spanish, French, Italian, Dutch, and Portuguese.",
"is_bot": false,
"headline": "release: v0.6.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T18:23:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8dcf6a43627b3e457f421cbb0df74688b4b520be",
"body": "### Added\n\n- Bundled German, Spanish, and French translations alongside the English baseline,\n so the sign-in screens and notification follow the application's locale out of the box.",
"is_bot": false,
"headline": "release: v0.5.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T17:17:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f5f188eafd0d370957cf266db17374b9c50b2f3b",
"body": "### Added\n\n- Optional WireKit (`pushery/wirekit`) sign-in screens. When WireKit is installed\n the views render with its components automatically; otherwise the plain Blade\n views are used. Controlled by the new `ui.mode` (`auto` / `blade`) and `ui.vite`\n configuration. The routes, CSRF-protected POSTs, and single-use consumption are\n unchanged — only the presentation differs.",
"is_bot": false,
"headline": "release: v0.4.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T15:28:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d96858882238bde496bc42efca29614e50e4c15",
"body": "### Added\n\n- Packagist badges (version, downloads, PHP version, license) in the README.\n\n### Documentation\n\n- Document that throttled (429) responses carry the `Retry-After` and\n `X-RateLimit-*` headers, so API and SPA clients can back off correctly.",
"is_bot": false,
"headline": "release: v0.3.1",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T14:47:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70751206b78e2dc9953d909a10b7d53a410587b1",
"body": "### Added\n\n- Translatable user-facing strings: the views and the mail notification now resolve\n every string through the `email-magic-link` translation namespace, with publishable\n language files (`--tag=email-magic-link-lang`).",
"is_bot": false,
"headline": "release: v0.3.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T14:29:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3fdefe9019b3a832accafa9229119bbd2b98ec38",
"body": "### Added\n\n- An `email-magic-link:install` command that publishes the configuration (and,\n with `--views`, the Blade views) and prints the setup steps.",
"is_bot": false,
"headline": "release: v0.2.0",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T14:05:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09a6775de837ea23ecd99a4bac8fd0e5332bcaa1",
"body": "### Security\n\n- Normalize the one-time-code regex with the `/u` flag for multibyte safety.\n\n### Documentation\n\n- Recommend layering a CAPTCHA on the request form for high-risk deployments.",
"is_bot": false,
"headline": "release: v0.1.1",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T13:33:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6894c560901a27515a29f6001bc6c56c10087cb6",
"body": null,
"is_bot": false,
"headline": "Create README.md",
"author_name": "PUSHERY",
"author_login": "pushery",
"committed_at": "2026-06-22T13:31:15Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 28,
"commits_last_year": 29,
"latest_release_at": "2026-08-03T11:27:06Z",
"latest_release_tag": "v0.20.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 5,
"days_since_latest_release": 0,
"mean_days_between_releases": 3.9
},
"artifacts": {
"collected": true,
"structure": [
"tree.migrations"
],
"declarations": [
{
"name": "pushery/email-magic-link-for-laravel",
"path": "composer.json",
"tokens": [
"composer.type:library"
],
"ecosystem": "packagist"
}
]
},
"community": {
"has_readme": true,
"has_license": true,
"readme_badges": {
"hosts": [
"shields.io"
],
"total": 5,
"header": 5,
"collected": true,
"has_inspect_badge": false
},
"has_description": true,
"has_contributing": true,
"health_percentage": 71,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "pushery/email-magic-link-for-laravel",
"exists": true,
"license": "MIT",
"keywords": [
"Authentication",
"login",
"laravel",
"otp",
"2fa",
"Passwordless",
"fortify",
"magic-link"
],
"ecosystem": "packagist",
"categories": [],
"matches_repo": true,
"registry_url": "https://packagist.org/packages/pushery/email-magic-link-for-laravel",
"declared_type": "library",
"is_deprecated": false,
"latest_version": "v0.20.0",
"repository_url": "https://github.com/pushery/email-magic-link-for-laravel",
"versions_count": 28,
"total_downloads": 3273,
"dependents_count": 0,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 3091,
"first_published_at": null,
"latest_published_at": "2026-08-03T11:27:02Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 1,
"stars": 40,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-07-30",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 16902,
"source_files_sampled": 85,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"composer.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"packagist"
],
"dependencies": [
{
"name": "laravel/framework",
"manifest": "composer.json",
"ecosystem": "packagist",
"version_constraint": "^13.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 28,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "pushery",
"commits": 30,
"avatar_url": "https://avatars.githubusercontent.com/u/272318911?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": false,
"has_tests": false,
"ci_workflows": [],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 28 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": null,
"reason": "no dependencies found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "3027c5b517215eb3c08ace69939a32c42f2e41f1",
"ran_at": "2026-08-03T11:29:53Z",
"aggregate_score": 3.2,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"recent_prs": {
"merged_7d": 1,
"decided_7d": 1,
"merged_30d": 8,
"authors_30d": 1,
"decided_30d": 8,
"sample_size": 28,
"window_days": 30,
"sample_exhausted": false,
"authors_probed_30d": 1,
"newcomer_merged_30d": 0,
"bot_prs_excluded_30d": 0,
"newcomer_authors_30d": 0,
"newcomer_decided_30d": 0
},
"ci_last_run_at": null,
"oldest_open_prs": [],
"last_merged_pr_at": "2026-08-03T11:27:03Z",
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/pushery/email-magic-link-for-laravel",
"host": "github.com",
"name": "email-magic-link-for-laravel",
"owner": "pushery"
},
"metrics": {
"overall": {
"key": "overall",
"band": "weak",
"name": "Overall health",
"note": "The weighted overall 44 is calibrated to 41 on the published index scale (record calibration 2026-08-02).",
"notes": [
{
"code": "overall_calibration",
"params": {
"raw": 44,
"calibrated": 41,
"calibration": "2026-08-02"
}
}
],
"value": 41,
"inputs": {
"security": 32,
"vitality": 72,
"community": 46,
"governance": 47,
"calibration": "2026-08-02",
"engineering": 21,
"ai_readiness": 24,
"weighted_overall_raw": 44
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 72,
"weight": 0.21,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"commits_last_year": 29,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "29 commits in the last year",
"points": 13.3,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 29
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "exceptional",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 28,
"latest_release_tag": "v0.20.0",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 3.9
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "28 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 28
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~3.9 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 3.9
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "exceptional",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "weak",
"name": "Community & Adoption",
"value": 46,
"weight": 0.17,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 26,
"inputs": {
"forks": 1,
"stars": 40,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "40 stars",
"points": 25.8,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 40
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"readme_badges": 5,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"readme_badge_services": [
"shields.io"
],
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "weak",
"name": "Ecosystem adoption (downloads)",
"note": null,
"notes": [],
"value": 46,
"inputs": {
"packages": [
"pushery/email-magic-link-for-laravel"
],
"dependents": 0,
"ecosystems": "packagist",
"total_downloads": 3273,
"monthly_downloads": 3091
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "3,091 downloads/month across packagist",
"points": 46.5,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 3091,
"ecosystems": "packagist"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "0 packages depend on it",
"points": 0,
"status": "missed",
"details": [
{
"code": "registry_dependents",
"params": {
"count": 0
}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "weak",
"name": "Sustainability & Governance",
"value": 47,
"weight": 0.23,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, Newcomer PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"newcomer_pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 67,
"inputs": {
"merged_prs": 28,
"open_issues": 0,
"closed_issues": 0,
"prs_merged_7d": 1,
"prs_decided_7d": 1,
"prs_merged_30d": 8,
"prs_decided_30d": 8,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0,
"first_time_authors_30d": 0,
"first_time_prs_merged_30d": 0,
"first_time_prs_decided_30d": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 42
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "28/28 decided PRs merged",
"points": 30,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 28,
"decided": 28
}
}
],
"max_points": 30
},
{
"key": "newcomer_pr_acceptance",
"name": "Newcomer PR acceptance",
"detail": "no first-time contributor's PR decided in 30d",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_newcomer_prs",
"params": {
"days": 30
}
}
],
"max_points": 13
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 29,
"inputs": {
"followers": 5,
"owner_type": "User",
"is_verified": null,
"owner_login": "pushery",
"public_repos": 7,
"account_age_days": 125
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "5 followers of pushery",
"points": 5.6,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 5,
"login": "pushery"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "7 public repos, account ~0 yr old",
"points": 7.3,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 7
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "exceptional",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"pushery/email-magic-link-for-laravel"
],
"ecosystems": "packagist",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on packagist",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "packagist"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "28 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 28
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 21,
"weight": 0.19,
"metrics": [
{
"key": "engineering_practices",
"band": "critical",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"has_ci": false,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 28 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [
"email",
"laravel",
"laravel-framework",
"laravel-package",
"mail",
"passwordless",
"passwordless-authentication",
"passwordless-login"
],
"has_wiki": false,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "8 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 8
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 32,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"dangerous_workflow",
"packaging",
"pinned_dependencies",
"signed_releases",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 32,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 13,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 5,
"scorecard_aggregate": 3.2
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 28 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "exceptional",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"commit_weight_rule": {
"min_commits": 50,
"min_commit_share": 0.1
},
"review_only_matches": 0,
"below_threshold_exposures": [],
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 24,
"weight": 0.04,
"metrics": [
{
"key": "ai_agent_context",
"band": "weak",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.933,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "28 of 30 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 28,
"sampled": 30
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_pinned_dependencies"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 30",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 30
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "PHP",
"largest_source_bytes": 16902,
"source_files_sampled": 85,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "PHP without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "PHP"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/85 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 85,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight: agent tooling is a real maintenance signal, but its absence must never gate the top of the scale (calibration saturates at raw 91, so 100/100 remains reachable with AI Readiness at zero)."
}
],
"classification": {
"top": [
"library",
"application"
],
"labels": [
"library",
"network-service"
],
"scores": {
"library": 22,
"network-service": 4
},
"primary": "library",
"evidence": [
{
"tier": "declared",
"label": "library",
"source": "composer.type:library",
"weight": 10
},
{
"tier": "distribution",
"label": "library",
"source": "registry:packagist",
"weight": 6
},
{
"tier": "distribution",
"label": "library",
"source": "registry_type:library",
"weight": 6
},
{
"tier": "dependencies",
"label": "network-service",
"source": "dep:laravel/framework",
"weight": 4
}
],
"artifacts": [
{
"path": "composer.json",
"labels": [
"library"
],
"ecosystem": "packagist"
}
],
"confidence": "high",
"host_extension": false,
"runs_as_process": true,
"consumed_by_code": true
},
"metrics_version": "2.5.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-08-03T11:30:09.357123Z",
"schema_version": "0.30.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/pushery/email-magic-link-for-laravel.svg",
"full_name": "pushery/email-magic-link-for-laravel",
"license_state": "standard",
"license_spdx": "MIT"
}Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v2.5.0, esquema v0.30.0 — metodología completa · wiki de métricas.
Cómo se sitúa un resultado dentro del registro general: estadísticas agregadas — Packagist.