spatie/security-advisories-health-check

Dangerous workflowscaution

One of four workflows uses pull_request_target for Dependabot auto-merge, which deserves review because that trigger can expose elevated workflow context. However, no untrusted checkouts or script-injection patterns were detected.

Security policycaution

The repository has no SECURITY.md or other detected security policy. This is a transparency gap, although the package does use Dependabot and the absence does not by itself indicate abandonment.

Token permissionscaution

Three of four workflows lack top-level permission declarations, and one workflow grants top-level write access. Explicit least-privilege declarations would improve repository hygiene, though this concerns project automation rather than normal package use.