muhammedsalama/laravel-base

Dangerous workflowscaution

Four workflows were analyzed without untrusted checkout or script-injection findings, but one release-drafter workflow uses pull_request_target, which warrants caution in a release-related automation path.

Maintainerscaution

Only one registry account has publish access. This is a continuity concern for a user-owned project, although the linked repository and recent activity show an identifiable active maintainer.

Project backingcaution

The package and repository are backed by the same individual user rather than an organization, so the single-contributor and single-publisher concerns are not offset by organizational ownership.

Repo bus factorcaution

One contributor made all six commits in the last three months, creating a meaningful single-maintainer continuity risk with no demonstrated handoff capacity.

Repo issue activitycaution

There are no open issues or pull requests and no recent issue or pull-request activity. This does not show abandonment by itself, but it provides little independent evidence of community engagement.