uzhlaravel/maishapay

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful warning about current maintenance capacity.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a package that handles payment integrations.

Workflow auditcaution

All 12 analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and workflow-safety concern rather than a severe standalone risk.