snipe/snipe-it

Lifecycle scriptscaution

The package runs post-autoload-dump and post-create-project-cmd scripts during Composer operations. These are relevant install-time behavior for a Laravel application and warrant awareness, but the signal alone does not show unsafe behavior.

Repo bus factorcaution

Although 21 contributors were active, one contributor made about 90% of the recent commits. The organization-owned project provides some handoff capacity, but this concentration remains a maintenance resilience concern.

Workflow auditcaution

All 11 workflows were analyzed successfully, with no untrusted checkout or script-injection findings. However, one high-confidence finding identifies an unpinned container image, and 30 of 36 action references are unpinned, leaving avoidable build-integrity risk.