elegantly/laravel-stripe

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a mild supply-chain consideration, but the provided signal does not show that it performs unsafe actions.

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance highly concentrated. Organization backing partially compensates because work can potentially be handed off.

Security policycaution

No security policy was found in the repository, reducing transparency for reporting vulnerabilities in a package that handles Stripe integrations.

Workflow auditcaution

All four workflows were analyzed, but all eight action references are unpinned. One workflow also has a high-confidence bot-conditions finding and top-level write permissions; no untrusted checkout or script-injection sink was reported, limiting the impact.