dragon-code/laravel-request-tracker

Lifecycle scriptscaution

Install-time post-autoload-dump and post-update-cmd scripts add execution during Composer operations, increasing integration and review risk compared with a package without lifecycle hooks.

Repo bus factorcaution

One contributor made all 26 commits in the last 3 months, creating a real single-maintainer continuity risk. Organization backing provides some handoff capacity, but no second active contributor is shown.

Security policycaution

The repository has no SECURITY.md or other declared security policy, leaving vulnerability reporting and response expectations unclear.

Token permissionscaution

Three workflows omit top-level token permissions and two declare write permissions, so the repository has weaker least-privilege workflow configuration than ideal. This is a transparency and automation-hygiene concern, not evidence that the release is unsafe by itself.