prakort/laravel-wellness

Project backingcaution

The package and repository are owned by the same individual account, so the single-person backing is consistent but offers limited visible organizational redundancy.

Release historycaution

Only one release exists, published about 21 months ago, with no releases in the last 12 months. That limits evidence of ongoing maintenance for a dependency.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months. This is a meaningful maintenance concern even though the repository was pushed more recently than that window.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, so this is workflow hygiene risk rather than a severe standalone issue.