luttje/laravel-user-custom-id

Workflow auditdanger

All 11 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. One pull_request_target workflow has no untrusted checkout or script-injection sink, so the trigger itself is not dangerous, but the workflow hygiene remains a concern.

Maintainerscaution

Only one registry account, luttje, has publish access. The linked repository is also owned by that individual, so there is no organization backing shown to compensate for the thin maintainer base.

Project backingcaution

The registry namespace and repository are owned by the same individual user, confirming consistent ownership but showing no organizational backing.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, indicating recently quiet development; the recent release history provides only partial compensation.

Repo popularitycaution

The repository has one star, zero forks, and one watcher. This is limited supporting evidence, but popularity alone is not decisive for a small package.