tehwave/laravel-achievements

Maintainerscaution

Only one account has registry publish access. That is a real publishing continuity risk for an individually owned project, although repository activity and recent release evidence show the account is active.

Project backingcaution

The registry namespace and repository owner match, and the repository is owned by the same individual rather than an organization. This supports package identity but provides limited institutional continuity.

Repo bus factorcaution

One contributor made all three commits in the last three months, creating a concentrated maintenance dependency. The project is user-owned rather than organization-backed, so there is no organizational handoff signal to offset it.

Repo commit activitycaution

The repository received three commits in the last three months, showing current maintenance, but the activity level is modest for a dependency.

Token permissionscaution

None of the three workflows declares top-level token permissions. No write permissions are explicitly requested, but the missing restrictions leave workflow privileges less transparent than they should be.