bigdevwhale/laravel-secure-baseline

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers during the past three months. For a security-scanning package, that lack of recent maintenance is a meaningful abandonment risk.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the source ownership is consistent. The single-person ownership context offers less maintenance redundancy than organizational backing.

Release historycaution

The package has four releases, all within roughly two days, and no release after January 26 despite being about eight months old at assessment time. This short burst followed by a long release gap raises maintenance risk.

Repo issue activitycaution

There is one open issue and no issue or pull-request activity in the past month. The low volume is not inherently concerning for a young small project, but it provides no evidence of current community or maintainer response.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, but all eight action references are unpinned and three workflows grant top-level write permissions. These are workflow hygiene concerns without a demonstrated exploit path, so they lower confidence in build reproducibility rather than making the package unfit.