fast-cmf/laradox

Workflow auditdanger

Both workflows were analyzed successfully, with no untrusted checkout or script-injection trigger issues, but all 17 action references are unpinned. The release-documentation workflow also has two high-confidence template-injection findings and uses top-level write permissions, making workflow hygiene a material supply-chain concern.

Project backingcaution

The repository owner is a GitHub user rather than an organization, so the single registry maintainer and concentrated ownership provide limited institutional backing. Two recent repository contributors partly offset that limitation.

Release historycaution

Five releases were published within less than one day, so the package is too new to demonstrate long-term release stability. The active repository and stable version designation partly compensate, but not for the limited history.

Repo popularitycaution

The repository has no stars, forks, or watchers. Because the package is newly released, this is weak supporting evidence rather than a standalone health concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. The workflow findings provide more concrete release-process concerns, so this missing scanner is a secondary caution.