teraone/laravel-cloudflare-zero-trust-middleware

Dangerous workflowscaution

Five workflows were analyzed with one pull_request_target workflow for Dependabot auto-merge, but there were no untrusted checkouts or script-injection findings; the targeted workflow merits review but is not severe on this evidence.

Dependency profilecaution

Six runtime dependencies, including Guzzle, Laravel contracts, and a JWT library, create a meaningful dependency surface for a small middleware package, but the profile is not unusually large on its own.

Lifecycle scriptscaution

A post-autoload-dump lifecycle script is present, adding some install-time behavior that should be reviewed, although the signal does not establish that it is unsafe.

Release historycaution

The package has existed for about 3 years and 7 releases, with the latest release published recently; however, only 1 release occurred in the last 12 months and the median interval is about 150 days, indicating modest rather than rapid maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months, which is a concrete maintenance-activity gap; the six recently merged pull requests provide partial compensating evidence but do not remove the caution.