devcode-it/openstamanager

Lifecycle scriptscaution

Four Composer lifecycle scripts run during installation or updates. These are relevant operational behavior for a full Laravel application, but the signal alone does not show unsafe or unexpected actions.

Repo issue activitycaution

Issues and pull requests remain active, with six new issues and four new pull requests in the last month, although only two issues and one pull request were closed or merged.

Version stabilitycaution

This is a prerelease despite being on a stable major line, and recent prereleases make up 20% of releases. The release notes explicitly say not to use this version in production, which materially lowers confidence for production adoption.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkout, injection, or high-severity findings, and one scopes permissions at job level. However, all 10 analyzed action references are unpinned, leaving avoidable workflow supply-chain exposure.