jeffersongoncalves/nativekitv5

Lifecycle scriptscaution

Four install and update lifecycle scripts run during Composer operations, increasing execution surface for consumers, although these scripts are consistent with a Laravel starter project.

Project backingcaution

The package and repository are owned by the same individual account, so the project has direct ownership but no organization-level maintenance backing is shown.

Workflow auditcaution

All six workflows were analyzed, all 15 action references are pinned, and no untrusted checkout or script-injection paths were found. However, a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow, while three workflows grant top-level write permissions.