pterodactyl/panel

Lifecycle scriptscaution

The package runs pre- and post-install/update Composer scripts. These are operationally relevant for a Laravel application and add some install-time complexity, but are not unusual for this package type.

Repo toolingcaution

Composer build tooling is present. No security scanning tools were detected, leaving a modest security-process gap for a substantial application.

Workflow auditcaution

All four workflows were analyzed and scope permissions at job level, with no untrusted checkout or script-injection trigger findings. However, the release workflow has a high-confidence template-injection finding, and 13 of 14 action references are unpinned; the low-confidence cache finding is only a hygiene concern.