blair2004/nexopos

Dependency profilecaution

The application declares 31 runtime dependencies and 6 development dependencies, a substantial profile that increases upgrade and transitive-risk surface. The breadth is also consistent with a full-featured POS/Laravel application, so this is a moderate caution rather than a severe health concern.

Lifecycle scriptscaution

Five install- or update-time Composer lifecycle scripts execute during common package operations, increasing installation complexity and the amount of code that runs automatically. This is a caution for dependency review, although such scripts can be expected for a full Laravel application.

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated contribution pattern is not visibly offset by organization-level maintenance backing.

Repo bus factorcaution

Although four contributors were active, the top contributor produced about 90% of the last three months' commits, leaving meaningful continuity risk for a user-owned project.

Token permissionscaution

Neither analyzed workflow declares top-level token permissions. While no top-level write permissions were detected, the absence of explicit permissions is a CI hardening gap.