masterix21/laravel-bookings

Maintainerscaution

Only one account has registry publishing access. The repository is also user-owned rather than organization-owned, so there is no provided organizational backing to offset the concentrated maintainer base.

Project backingcaution

The package and repository share the same user owner, confirming the repository relationship, but the owner type is User rather than Organization and does not provide broader backing.

Repo bus factorcaution

One contributor made all 23 commits in the last three months, giving the project a single-maintainer bus factor and increasing continuity risk if that contributor becomes unavailable.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a hygiene gap, partially offset by the repository's separate security policy.

Workflow auditcaution

All five workflows were analyzed, but all 14 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a caution rather than a standalone severe risk.