plusinfolab/cashier-saas-metrics

Lifecycle scriptscaution

A post-autoload-dump install script runs during Composer installation. This adds execution surface, but the signal does not show that the script performs unsafe or unexpected work.

Release historycaution

Only one release exists over 179 days, with no established release cadence yet. This is a meaningful maturity concern for a package intended as a Laravel library.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. Although the repository was pushed recently, the measured inactivity lowers confidence in ongoing maintenance.

Security policycaution

No security policy is present in the repository. This is a transparency gap for a package handling billing integrations, though it does not establish that the code is unsafe.

Workflow auditcaution

All 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are hygiene and maintenance risks rather than a standalone severe risk.