longestdrive/laravel-golf-handicap-calculator

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which carries elevated workflow risk, but no untrusted checkouts or script-injection patterns were detected.

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script is present. This is a mild transparency and execution-surface concern, but it is a common Composer mechanism and is not severe on its own.

Maintainerscaution

Only one registry publishing account is listed. That is a resilience concern for a user-owned project, although the matching repository and observed release activity provide some backing.

Release historycaution

The package is about 405 days old with five releases and two releases in the last 12 months, showing some continued publication but a relatively small and uneven release history.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months. This is the strongest maintenance concern, although the repository was pushed recently and the package has a current release.