samuelterra22/laravel-report-generator

Workflow auditdanger

All 14 analyzed action references are unpinned, creating avoidable workflow supply-chain drift. The audit also found one high-confidence bot-conditions issue in the Dependabot auto-merge workflow; the pull_request_target trigger had no untrusted checkout or script-injection sink, so this is serious hygiene risk rather than a standalone package verdict.

Maintainerscaution

Only one account has registry publish access, which limits publishing redundancy. The repository is user-owned rather than organization-backed, so there is no provided organizational capacity to offset that limitation.

Release historycaution

The package has only two releases across roughly eight years, with one release in the last 12 months and a median interval of about 7.7 years. The recent release helps, but the long gaps indicate limited release maturity.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last three months. Although it was pushed recently and the release included changes, the current commit inactivity limits confidence in ongoing maintenance.

Security policycaution

The repository has no documented security policy. This is a transparency gap for reporting vulnerabilities, though the repository's automated security scanning partly offsets the broader security-process concern.