yangusik/laravel-spawn

Project backingcaution

The repository is owned by a user rather than an organization, so the concentrated contributor activity is not offset by visible organization-level maintenance backing.

Repo bus factorcaution

One contributor made about 85% of the 75 recent commits, while the other two contributed far less; this concentration creates a meaningful continuity risk for a user-owned project.

Repo toolingcaution

Composer build tooling is used, but no security-scanning tools were observed; the missing security automation is a transparency and maintenance gap, though it is not evidence of a vulnerability by itself.

Security policycaution

The repository has no security policy, leaving the process for reporting and handling vulnerabilities undocumented.

Token permissionscaution

Neither of the two workflows declares top-level token permissions, so least-privilege CI behavior is not explicit even though no top-level write permissions were observed.