yuwuhsien/laravel-bcmath-cast

Maintainerscaution

Only one account has registry publish access, which is a modest operational concentration risk for an individually owned project, but repository activity shows another active contributor.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no demonstrated organizational handoff capacity; however, two contributors are active in recent commits.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are reported, leaving a minor repository hygiene gap.

Security policycaution

The repository has no SECURITY.md policy. This is a transparency gap, though it is less concerning for a small package with recent activity and no reported workflow audit findings.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous or severity-rated findings, and it has no untrusted checkout or script-injection paths. Both of its action references are unpinned, which weakens build reproducibility and supply-chain hygiene.