ohdearapp/laravel-ohdear-webhooks

Repo bus factorcaution

All recent repository commits came from one contributor, creating a concentrated maintenance path. Organizational backing reduces the risk compared with an unaffiliated project, but does not remove it.

Repo commit activitycaution

Only one commit was recorded in the last 3 months by one active maintainer. The recent release and organizational ownership compensate for some of this thin activity, but it remains a maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a transparency and assurance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations undocumented.

Token permissionscaution

None of the three workflows declares top-level token permissions. No workflow requests top-level write access, but explicit least-privilege configuration is still missing.