centrex/laravel-security

Lifecycle scriptscaution

A post-autoload-dump install-time script is present, adding execution during installation; this is a mild supply-chain hygiene concern without evidence here of harmful behavior.

Package scaffoldingcaution

The artifact includes a README and changelog, and the repository has tests and a changelog. However, the README contains substantial template text and limited package-specific guidance, reducing transparency for consumers.

Repo bus factorcaution

One contributor made all four recent commits, giving the project a concentrated maintenance dependency. Organization ownership provides some handoff capacity but does not remove the current concentration.

Security policycaution

The repository has no security policy, which is a transparency gap for a package explicitly focused on security functionality.

Workflow auditcaution

All 13 action references are unpinned, four workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, so this is a serious hygiene concern rather than a standalone severe risk.