spatie/browsershot

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk. The repository is organization-owned, so handoff capacity partly offsets the concern.

Repo commit activitycaution

Only 1 commit from 1 active maintainer was recorded in the last 3 months, which is thin recent activity, though the release history and organization backing provide context against abandonment.

Security policycaution

No repository security policy was found, leaving reporting and response guidance less transparent for a package that runs browser-related tooling.

Workflow auditcaution

All four workflows were analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection paths. However, all 9 action references are unpinned, two workflows grant top-level write permissions, and one high-confidence low-severity audit found an adhoc package install.