sameoldnick/laravel-ntfy

Maintainerscaution

Only one registry account has publish access. That is a manageable publishing risk for a small project, but it leaves little registry-side redundancy.

Project backingcaution

The repository is owned by a user rather than an organization, so the single-maintainer and single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 55 recent commits came from one contributor, so maintenance depends entirely on that person and could be vulnerable to an interruption.

Workflow auditcaution

The audit completed all two workflows with read-only permissions and no untrusted checkout or script-injection paths. However, four of six actions are unpinned and a high-confidence low-severity finding reports installing a package outside a lockfile.