marin-solutions/checkybot-laravel

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer operations, adding execution surface that adopters should understand, though this is not severe on its own.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a meaningful repository hygiene gap.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response expectations.

Version stabilitycaution

v0.2.1 is not yet a stable major release, so compatibility may still change, although it is not marked as a prerelease.

Workflow auditcaution

All 16 analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; three workflows also grant top-level write permissions. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this remains a caution rather than a severe risk.