mateusjunges/laravel-kafka

Dangerous workflowscaution

One of two workflows uses pull_request_target, which warrants review because that trigger can run with elevated repository context, although no untrusted checkout or script-injection pattern was detected.

Maintainerscaution

Only one registry publishing account is listed, which creates some publishing continuity risk, although the repository shows activity from two contributors.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, so vulnerability-reporting and response expectations are not documented.

Token permissionscaution

One workflow lacks top-level token permissions and another grants top-level write permissions, leaving the CI authorization model broader or less explicit than ideal.