flagpal/flagpal-for-laravel

Dangerous workflowscaution

One pull_request_target workflow is present, which deserves workflow review, but there are no detected untrusted checkouts or script-injection patterns.

Dependency profilecaution

Eleven runtime dependencies are meaningful for a Laravel integration package and include framework, HTTP, and API-client components; the profile is not evidence of abandonment, but it creates some dependency-surface overhead.

Lifecycle scriptscaution

A post-autoload-dump install-time script increases installation complexity and warrants review, although one Composer lifecycle script is not by itself a severe health risk.

Repo popularitycaution

The repository has only 1 star and 1 fork, so external adoption evidence is limited; popularity is supporting evidence rather than a decisive health criterion.

Security policycaution

No SECURITY.md policy was found, reducing vulnerability-reporting transparency; this is a hygiene gap rather than evidence that the package is unsafe.