etsvthor/laravel-cashregister-bridge

Lifecycle scriptscaution

The package runs a post-autoload-dump Composer lifecycle script. This is a supply-chain-sensitive install behavior and adds some adoption risk, although no more dangerous script detail was provided.

Repo bus factorcaution

All 4 recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown, so continuity remains a concern.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations less transparent for users of this integration package.

Workflow auditcaution

All 7 analyzed action references are unpinned, two workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, but the combined workflow hygiene still raises publishing risk.