backtik-ch/laravel-kchat-sdk

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge. No untrusted checkouts or script-injection patterns were detected, but this privileged workflow warrants review.

Lifecycle scriptscaution

A post-autoload-dump install script introduces some install-time behavior that consumers should review, though this single standard Composer lifecycle hook is not by itself a severe concern.

Release historycaution

The package is only 93 days old and has two releases, both published within about 2 hours, so its long-term maintenance record is still unproven.

Repo bus factorcaution

One contributor made all five commits in the last three months, creating concentration risk; organization backing provides some ability to hand maintenance off, so this is a caution rather than a severe risk.

Repo commit activitycaution

Five commits in the last three months show recent activity, but the volume is modest and does not yet establish a durable maintenance pattern.