coderflex/filament-turnstile
The project has clear documentation, repository tests, and regular releases. Unpinned workflow actions and a high-confidence bot-condition warning add supply-chain hygiene concerns, while no commits in three months leaves current maintenance uncertain.
68%
Total Score
75
100
50
Health Score Breakdown
The package runs a post-autoload-dump install-time script. This is a routine Composer lifecycle hook, but it gives installation behavior more scope than a package without scripts.
The repository recorded zero commits and zero active maintainers in the last three months. This is concerning for current maintenance, although the recent release history provides some compensating evidence.
No SECURITY.md policy was found. That weakens vulnerability-reporting transparency, though it is a moderate gap rather than evidence that the package is unmaintained.
All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The audit also found one high-confidence bot-conditions issue in the Dependabot auto-merge workflow; the ordinary pull_request_target trigger had no untrusted checkout or script-injection sink.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Oussama |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 illuminate/contracts Version ^11.28|^12.0|^13.0 | — | — |
coderflex/laravel-turnstile Version ^2.0 | — | — |
spatie/laravel-package-tools Version ^1.14.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 3 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.