uneca/dashboard-starter-kit

Lifecycle scriptscaution

The package runs a post-autoload-dump Composer lifecycle script. This is a normal Composer integration point, but it adds install-time behavior that should be understood before automated deployment.

Repo bus factorcaution

All 44 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tooling was detected. The missing automated security coverage is a modest project-hygiene gap.

Security policycaution

The repository has no published security policy. This weakens disclosure transparency for a package intended to underpin dashboard applications.

Workflow auditcaution

The sole workflow gives all jobs top-level write access, leaves all five action references unpinned, and installs a package outside a lockfile. The audit found no untrusted checkout or script-injection path, so these are meaningful hygiene concerns rather than a severe workflow risk.