stats4sd/laravel-shiny-loader

Lifecycle scriptscaution

A post-autoload-dump install script runs during Composer installation. This is a meaningful execution point for consumers, though the signal does not show that the script is harmful.

Repo bus factorcaution

All 12 commits in the last 3 months came from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown, leaving a real continuity concern.

Security policycaution

The repository has no security policy file. That weakens vulnerability-reporting transparency for a package involved in authentication and Shiny app integration.

Workflow auditcaution

All 12 analyzed action references are unpinned, which weakens build reproducibility and increases dependency-drift risk. The audit also found a high-confidence bot-condition issue, but no untrusted checkout or script injection was detected, so it does not independently make the release unsafe.