albetnov/sanctum-refresh

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which adds execution during installation and warrants attention even though this is a normal Composer mechanism.

Repo bus factorcaution

All recent commits come from one contributor, leaving the project dependent on a single person for maintenance and release continuity.

Repo commit activitycaution

Eight commits were made in the last three months, showing current activity, but all were made by one active maintainer.

Security policycaution

The repository has no SECURITY.md or other security policy, reducing transparency for reporting vulnerabilities in a package that handles authentication tokens.

Workflow auditcaution

All 15 analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; the pull-request-target trigger has no untrusted checkout or script-injection finding, limiting the risk to workflow hygiene.