ethanfly/businesspay-laravel

Project backingcaution

The repository is owned by an individual account, so the single-contributor concentration is not offset by organization-level maintenance capacity.

Release historycaution

The package is only 94 days old with two releases, so there is limited evidence of long-term maintenance and release stability.

Repo bus factorcaution

All nine recent commits came from one contributor, leaving maintenance dependent on a single person and creating a meaningful continuity risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented for a payment-related SDK.

Workflow auditcaution

The sole workflow has high-confidence template-injection exposure, grants top-level write permissions, and leaves all seven action references unpinned. No untrusted checkout or script-injection path was found, so this is workflow hygiene and release risk rather than a severe standalone verdict.