spam-n-eggs/laravel-mysqlite

Workflow auditdanger

The audit found a high-confidence template-injection finding in a pull_request_target workflow that also performs an untrusted checkout, creating a meaningful workflow supply-chain risk. All 16 action references are unpinned and all three workflows grant top-level write permissions, adding reproducibility and permission concerns.

Repo bus factorcaution

One contributor made all six commits in the last three months, giving the project a single-person active bus factor. Organizational ownership provides some handoff capacity but no second recently active contributor is shown.

Repo commit activitycaution

Six commits were made in the last three months, showing recent activity, but all came from one active maintainer. The activity is current but concentrated.

Security policycaution

The repository has no security policy. This is a transparency and incident-reporting gap, although the reported automated security scanning partly offsets the concern.