deifhelt/laravel-reports

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script is present. This is an execution-time consideration, but the signal alone does not show unusual or unsafe behavior.

Repo bus factorcaution

One contributor made all two commits in the last three months. This creates a clear continuity risk, and the repository is user-owned rather than organization-backed.

Repo commit activitycaution

Only two commits were recorded in the last three months. That is some recent activity, but it is a thin maintenance pace for a package consumers may depend on.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although the absence is a hygiene concern rather than evidence of abandonment.

Workflow auditcaution

All 12 action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow; no untrusted checkout or script injection was found, so this remains a meaningful caution rather than a severe risk.