codebar-ag/laravel-feature-policy

Dangerous workflowscaution

One workflow uses pull_request_target for automated Dependabot merging, which warrants care because that trigger has elevated workflow context, although no untrusted checkout or script-injection patterns were detected.

Release historycaution

The package is only 166 days old and has just two releases, both published within about 9 minutes, so its long-term release maturity is not yet established.

Repo commit activitycaution

The repository records zero commits and zero active maintainers over the last three months, a meaningful maintenance concern for a package whose release history is also very short.

Repo popularitycaution

The repository has no stars, forks, or watchers. This is weak supporting evidence rather than a decisive problem, especially for a package only 166 days old.

Token permissionscaution

Six of nine workflows lack top-level permission declarations and two request top-level write access, so workflow privileges are less tightly constrained than ideal.