joinloops/loops-server

Lifecycle scriptscaution

Several Composer install and update lifecycle scripts are present, which is expected for a Laravel application with setup commands but increases install-time behavior that consumers should understand.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations and handling procedures less transparent.

Version stabilitycaution

This is a beta release, and all recent releases are prereleases, so compatibility may still change. The stable major version label provides some maturity context but does not remove the prerelease risk.

Workflow auditcaution

All nine workflows use top-level write permissions and all 30 analyzed action references are unpinned, while a high-confidence template-injection finding appears in docker-tag.yml. No untrusted checkout or script-injection path was found, so this is a workflow hygiene concern rather than a standalone severe health risk.