bisual/laravel-shortcuts

Lifecycle scriptscaution

The package uses a post-autoload-dump lifecycle script. This is an install-time execution surface that warrants review, but the signal alone does not show harmful behavior.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Workflow auditcaution

All 11 analyzed action references are unpinned, and the audit found a medium-confidence, high-severity bot-condition issue in the Dependabot auto-merge workflow; top-level write permissions also appear in two workflows, though no untrusted checkout or script injection was found.