foxws/laravel-scout-relations

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because it can run with elevated repository context. However, no untrusted checkout or script-injection patterns were detected across the five analyzed workflows.

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a meaningful install-time behavior to review, but the signal provides no evidence that it is unsafe or unusually broad.

Maintainerscaution

Only one registry account has publish access, which is a narrow publishing base. The organization-owned repository and recent activity provide some compensation, but registry continuity still depends on one account.

Repo popularitycaution

The repository has one star and no forks or watchers. This indicates limited external adoption, but popularity is supporting evidence and does not outweigh the repository's active maintenance signals.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, not evidence that the package is unsafe.