codebar-ag/laravel-postfinance-b2b

Dangerous workflowscaution

One of seven workflows uses pull_request_target for Dependabot auto-merge, but no untrusted checkouts or script-injection patterns were detected. The isolated use is worth awareness but is not a severe health risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Frequent historical releases partly compensate, but the current lack of development activity is a maintenance concern.

Repo issue activitycaution

There were four open issues and two open pull requests, but no new or closed issues or pull requests in the last month. This suggests limited current project interaction.

Token permissionscaution

Four workflows lack top-level token permissions, and two declare top-level write access. This weakens workflow hardening and increases maintenance risk, although one workflow explicitly uses read-only permissions.

Version stabilitycaution

The release is not marked as a stable major, and the registry reports the latest version as v0.9.0 despite the assessed v12.0 release. This versioning inconsistency makes maturity harder to judge.