dev-to-geek/laravel-init

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, but no analyzed workflow performs an untrusted checkout or script injection, limiting the observed workflow risk.

Lifecycle scriptscaution

A post-autoload-dump script runs during installation, so installation has executable lifecycle behavior that deserves review, though this is common Composer package practice and is not severe by itself.

Maintainerscaution

Only one account has registry publish access, which is a durability concern, although the repository is owned by an organization, providing some backing context.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign of currently slow maintenance and increased abandonment risk.

Repo issue activitycaution

There are no open issues and three open pull requests, but none were merged in the last month, so current project responsiveness is not demonstrated.