mykholy/laravel-accessproof

Workflow auditdanger

The release workflow uses a workflow_run trigger, checks out untrusted data, has top-level write permissions, and leaves all 7 action references unpinned. The audit completed cleanly with no classified findings, but this combination creates meaningful release-workflow supply-chain exposure.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so there is no namespace mismatch. The individual ownership also means the project does not show organizational backing to compensate for its very recent history.

Release historycaution

The package is only 0 days old, with four releases arriving within about 12 hours and a median interval of roughly 12 minutes. This shows active initial development but provides almost no evidence of sustained maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a package focused on authorization regression testing, the missing security scanning is a modest transparency and hygiene gap.