spatie/invade

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap but not evidence of abandonment.

Workflow auditcaution

All five workflows were analyzed, but all 11 action references are unpinned and a high-confidence finding identifies an unpinned container image. The pull_request_target workflow has no untrusted checkout or script-injection sink, so this remains a CI hygiene concern rather than a severe risk.