mlmendes/laravel-react-starter-kit

Lifecycle scriptscaution

The package defines four Composer lifecycle scripts, including project creation and update hooks. These are plausible for a Laravel starter application but add install-time behavior that consumers should understand.

Project backingcaution

The repository is owned by an individual account rather than an organization. Combined with all recent commits coming from one contributor, there is no provided backing evidence to offset the concentrated maintainer risk.

Repo bus factorcaution

One contributor made all 83 commits in the last three months, leaving the project dependent on a single maintainer. This materially increases continuity risk if that maintainer becomes unavailable.

Security policycaution

The repository has no security policy. For a Laravel starter application handling authentication, permissions, and one-time passwords, that is a meaningful transparency and vulnerability-reporting gap.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings, no untrusted checkouts, no script injection, and all five action references pinned. One workflow grants top-level write permissions, a mild token-scope concern, but no untrusted trigger or sink corroborates a severe risk.