victormgomes/laravel-query-engine

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. This is common in Composer packages but adds install-time behavior that should be understood before adoption.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer and concentrated-contributor risks are not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all 33 commits in the last three months, concentrating maintenance and release knowledge in a single person and increasing continuity risk.

Repo popularitycaution

The repository has only 2 stars, no forks, and no watchers. Popularity is supporting evidence rather than a verdict, but these counts provide little external adoption signal.

Workflow auditcaution

All four workflows were analyzed, with no untrusted checkouts or script-injection sinks, but all 13 action references are unpinned and three workflows grant top-level write access. High-confidence bot-condition and template-injection findings, plus inherited secrets and ad hoc package installation, reduce workflow hygiene.