spatie/dropbox-api

Security policycaution

No repository security policy was found. This is a modest transparency gap for a package that handles API authorization tokens, though Dependabot and the workflow audit provide some compensating maintenance evidence.

Workflow auditcaution

All 13 analyzed action references are unpinned, which weakens reproducibility and update control. The audit found no untrusted checkout, script injection, or other reported findings; the pull_request_target workflow and limited top-level write permissions are not dangerous on their own.