sansanlabs/laravel-git-ftp-deployer

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. This is a relevant execution-time surface, but no provided evidence shows that it is unsafe.

Maintainerscaution

Only one registry publisher is listed, which limits publishing redundancy, but the repository is owned by an organization, making a short registry list less concerning.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent release and June push provide some recency, but the current pause still raises maintenance risk.

Security policycaution

No repository security policy was found, leaving disclosure and response expectations undocumented.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The high-confidence bot-conditions finding in a pull_request_target workflow adds workflow hygiene risk, although no untrusted checkout or script-injection sink was found.