hoogi91/access-restriction

Lifecycle scriptscaution

A post-autoload-dump Composer script is present. This is a normal integration point, but it adds install-time behavior that should be understood before deployment.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the source linkage is consistent, but there is no observed organization backing to compensate for a small maintainer base.

Release historycaution

The latest registry release was in January 2023, with no releases in the following 12 months and only four releases overall. This indicates slow publishing activity, although the linked repository was updated more recently.

Repo commit activitycaution

There were no commits and no active maintainers in the three months before collection. Combined with the old latest registry release, this raises maintenance and abandonment concerns.

Workflow auditcaution

All eight analyzed action references are unpinned, and the auto-approve workflow combines pull_request_target with top-level write permissions and a high-confidence bot-condition finding. The audit completed fully, but this workflow configuration is a meaningful supply-chain hygiene concern.