waapi/waapi-laravel-sdk

Dangerous workflowscaution

Five workflows were analyzed; one uses pull_request_target, but there are no untrusted checkouts or script-injection findings. The workflow profile merits review but does not show a severe issue from the collected indicators.

Lifecycle scriptscaution

A post-autoload-dump lifecycle script is present. This is a potentially relevant install-time behavior, but the signal provides no evidence that it is unusually risky or unrelated to normal Composer package setup.

Maintainerscaution

Only one registry account, WaAPI, has publish access. Because the repository owner is identified as a user rather than an organization, this creates some continuity and publishing-account concentration risk.

Project backingcaution

The repository is owned by the user account WaAPIapp rather than an organization. This does not invalidate the package, but it provides less demonstrated handoff capacity for a single-maintainer project.

Repo bus factorcaution

All 2 recent commits came from a single contributor, with a 100% top-contributor share and one contributor total. Without organization backing, this is a meaningful bus-factor risk.