jeffersongoncalves/helpdeskkitv5

Dependency profilecaution

The package declares 15 runtime dependencies, including several related Filament and Laravel packages. This is a substantial dependency surface and increases maintenance coupling, though it is consistent with a full starter kit.

Lifecycle scriptscaution

The package runs four Composer lifecycle scripts, including post-install and post-update hooks. These can execute package-controlled behavior during installation, so they add supply-chain exposure even though they may be normal for this Laravel starter kit.

Project backingcaution

The repository is owned by an individual account rather than an organization, so maintenance depends on a personal project owner. This is partly offset by the second active contributor and recent release activity.

Repo bus factorcaution

Two contributors were active in the last three months, with the leading contributor responsible for about 58% of commits. The second contributor's 42% share provides meaningful, though still limited, redundancy.

Workflow auditcaution

All six workflows were analyzed, all 15 action references are pinned, and no untrusted checkouts or script injections were found. However, the auditor reported one high-confidence bot-conditions finding in the Dependabot auto-merge workflow, and two workflows grant top-level write permissions, creating a real workflow-hygiene concern.