abr4xas/clarity-laravel

Maintainerscaution

Only one registry account has publish access. The linked repository is user-owned, so there is no organization backing shown to compensate for this concentrated publishing responsibility.

Project backingcaution

The package and repository are both owned by the same individual account, confirming coherent ownership but providing no organizational maintenance capacity.

Repo bus factorcaution

All three recent commits came from one contributor, leaving maintenance highly concentrated and increasing abandonment or handoff risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented.

Workflow auditcaution

All 11 action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; three workflows also grant top-level write access. The pull_request_target workflow has no untrusted checkout or script-injection finding, so this is a meaningful hygiene concern rather than a standalone severe verdict.