webhubworks/weclapp-api-laravel

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. This is a supply-chain-relevant installation hook, though the signal provides no evidence that its behavior is unsafe.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, weakening evidence of active maintenance despite recent registry releases.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool is configured, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, so there is no documented process for reporting or handling vulnerabilities.

Workflow auditcaution

All 8 analyzed action references are unpinned, and two of three workflows grant top-level write permissions. The audit found no untrusted checkout, script injection, or high-severity finding, so this is workflow hygiene caution rather than a severe risk.