spatie/laravel-medialibrary

Dangerous workflowscaution

One of five workflows uses pull_request_target, which warrants review because that trigger can handle untrusted pull-request input with elevated repository context; no untrusted checkouts or script injection were detected.

Dependency profilecaution

The package has 16 runtime dependencies, including framework components and image or filesystem support libraries; this is a meaningful dependency surface but is consistent with its broad media-handling functionality.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations less transparent than ideal for a widely used package.

Token permissionscaution

Four workflows lack top-level token permissions, and one workflow has top-level write access. This is a permissions-hygiene gap, although no broader workflow execution flaws were found.