stackkit/laravel-google-cloud-tasks-queue

Workflow auditdanger

All 9 analyzed action references are unpinned, and one workflow combines pull_request_target with an untrusted checkout; the two workflows with top-level write permissions further widen credential scope. The audit completed cleanly with no reported high-confidence findings, but these workflow choices remain meaningful supply-chain hygiene risks.

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated bus factor. Organizational ownership partly mitigates handoff risk but does not remove the current dependence on one active contributor.

Repo commit activitycaution

Only 2 commits were made in the last 3 months by one active maintainer. This shows some recent work but a thin current maintenance base.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a maintenance and security-hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.