elegantly/blade-kit

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during installation; this is a genuine execution-time consideration, although the signal does not show that the script is unsafe.

Repo bus factorcaution

All 25 recent commits came from one contributor, leaving maintenance dependent on a single active person; organization backing helps but does not remove this concentration risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest gap in the project's defensive practices.

Security policycaution

The repository has no published security policy, reducing transparency about how vulnerability reports are handled.

Workflow auditcaution

All four workflows were analyzed without high-confidence findings or untrusted triggers, but all 10 action references are unpinned and one workflow grants top-level write access, creating mild reproducibility and permission concerns.