seatplus/core

Lifecycle scriptscaution

Four install and update lifecycle scripts are present. They are normal for a Laravel application package but add execution surface during Composer operations.

Repo popularitycaution

The repository has only 1 star and 1 fork, so external adoption is limited. Popularity is supporting evidence rather than a health verdict, and the activity signals provide stronger evidence here.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That leaves a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although active commits and releases partly compensate for the gap.

Workflow auditcaution

All 12 analyzed action references are unpinned, and a high-confidence finding reports a GitHub App token inheriting blanket installation permissions; an additional workflow installs a package outside a lockfile. No untrusted checkout or script-injection path was found, limiting the impact to caution rather than a severe verdict.