worksome/laravel-mfa

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a meaningful maintenance slowdown despite the recent release history.

Version stabilitycaution

This is a non-prerelease 0.3.0 release, but the 0.x major version means compatibility guarantees are weaker than for a stable-major package.

Workflow auditcaution

All nine action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a standalone severe risk.