qcod/laravel-imageup

Repo bus factorcaution

All recent commits came from one contributor, so maintenance knowledge is concentrated; organization ownership partly reduces the risk but does not provide evidence of a second active maintainer.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, indicating limited recent development activity even though it produced the current release.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest transparency and monitoring gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less clear for a package handling uploaded images.

Workflow auditcaution

The single workflow was fully analyzed with no injection, dangerous-trigger, or audit findings, but both action references are unpinned, weakening build reproducibility.