amzad/laravel-purchasable

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because that trigger can expose elevated repository context. However, the scan found no untrusted checkout or script-injection patterns.

Lifecycle scriptscaution

The package uses a post-autoload-dump install lifecycle script. This adds installation-time behavior that deserves review, but it is not severe on its own and no other supplied signal indicates that the script is unsafe.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the concentrated contributor activity and single registry maintainer represent the actual available maintenance base. Recent commits partly compensate for that limited backing.

Repo bus factorcaution

Two contributors were active, but the leading contributor made 80% of recent commits. The second contributor provides some continuity, while the concentration still creates a moderate maintenance risk for a user-owned project.

Security policycaution

The repository has no security policy. That reduces transparency about vulnerability reporting and response, though it does not by itself indicate abandonment.