spatie/ray

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which carries elevated workflow risk. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Repo commit activitycaution

No commits or active maintainers were recorded during the last three months, despite the strong longer-term release history. This is a meaningful short-term maintenance concern, though it is not evidence of abandonment by itself.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency for a package used in application debugging, although other repository security tooling is present.

Token permissionscaution

Four of five workflows lack top-level token permissions, and the auto-merge workflow has top-level write access. This is weaker least-privilege hygiene, although no other workflow-risk indicators show untrusted checkout or script injection.