creativecrafts/laravel-sso

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This is an operational surface that deserves review, although the signal does not show that the script is unsafe.

Release historycaution

The package is only 85 days old and has five releases clustered around its initial publication, so long-term maintenance and stability are not yet established.

Workflow auditcaution

All three workflows were analyzed, but all 10 action references are unpinned and two workflows grant top-level write access. A high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this is caution rather than a severe verdict.