bakewizard/bakekit

Lifecycle scriptscaution

Composer install-time scripts run post-create-project and post-install commands. These are plausible for a starter application but add execution during installation and deserve more trust than a package without lifecycle hooks.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no provided organizational backing to offset the concentrated contributor base.

Repo bus factorcaution

One contributor made all 9 recent commits, so maintenance depends heavily on a single person and could be disrupted if they stop contributing.

Repo commit activitycaution

The repository has 9 commits in the last 3 months, indicating recent work, but all recent commits came from one active maintainer.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That leaves less automated protection for a package handling authentication and permissions.