mattitjaab/matomo-proxy-laravel

Workflow auditdanger

All five workflows were analyzed, but all 12 action references are unpinned and a high-confidence bot-conditions finding reports spoofable actor checks in the Dependabot auto-merge workflow. Three workflows also grant top-level write permissions, increasing workflow hygiene risk.

Lifecycle scriptscaution

A post-autoload-dump script runs during installation, adding some install-time behavior that consumers should understand, but this signal alone does not show harmful or unusual activity.

Release historycaution

This is the only release, published about 13 months ago, with no releases in the last 12 months. That limited history makes long-term maintenance harder to establish.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with only one release, this leaves maintenance continuity uncertain.

Repo issue activitycaution

There are four open pull requests but no new or merged pull requests in the last month, suggesting pending work without recent visible throughput.