marjose123/starter-kit

Lifecycle scriptscaution

The package declares several Composer lifecycle scripts, including post-create-project-cmd and post-update-cmd. These are common for a Laravel starter kit but increase installation and update behavior that dependents must understand.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although the release history is recent, this is a meaningful sign that active development may have slowed.

Security policycaution

The repository has no security policy. For a Laravel starter kit handling authentication, sessions, and API tokens, that is a transparency and vulnerability-reporting gap.

Workflow auditcaution

All 17 analyzed action references are unpinned, and a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow. The audit found no untrusted checkout or script-injection sink, so this is workflow hygiene and automation risk rather than a severe standalone verdict.