laravel/pulse

Dangerous workflowscaution

One of nine workflows uses pull_request_target, creating some CI security exposure, but there are no untrusted checkouts or script-injection findings.

Dependency profilecaution

The package declares 21 runtime dependencies, including several Laravel components and Livewire; this is a relatively broad integration surface but is coherent with a performance-monitoring dashboard package.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present, which adds execution surface during installation; this is a routine Composer hook but merits review before adoption.

Token permissionscaution

Six of nine workflows declare top-level write permissions, broader than necessary in many repositories; three use read-only permissions, so this is a meaningful but not disqualifying workflow-hardening concern.