avto-dev/json-rpc-laravel

Repo bus factorcaution

All three recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some ability to hand maintenance off, so this is a caution rather than a severe abandonment signal.

Repo toolingcaution

The project uses Composer and Make, but no security-scanning tools were detected. This is a transparency and hygiene gap, not evidence that the release is unsafe.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear for a network-facing RPC integration.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection path, but all five action references are unpinned. The auditor also reported a high-severity cache-poisoning pattern with low confidence, which warrants hygiene caution rather than a severe conclusion.