zing/laravel-query-builder

Project backingcaution

The repository is owned by a user rather than an organization, so the concentrated recent contributor activity represents a genuine single-owner continuity risk.

Repo bus factorcaution

One contributor made all commits during the last three months, concentrating maintenance responsibility in a single person and increasing continuity risk for a user-owned project.

Repo commit activitycaution

Only one commit was recorded in the last three months, which is thin activity for an actively maintained library, although recent merges and the current release provide compensating evidence.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations unclear despite the presence of security scanning tools.

Workflow auditcaution

All 14 analyzed action references are unpinned, and one high-confidence medium-severity finding reports an archived action. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.