primefaces

Dangerous workflowscaution

No pull_request_target workflows or script-injection patterns were detected, but one of 11 workflows uses an untrusted checkout. This is a limited workflow supply-chain hygiene concern that merits review.

Security policycaution

No SECURITY.md or equivalent security policy was found in the repository. For a widely used framework this is a genuine disclosure and maintenance-transparency gap.

Token permissionscaution

Seven workflows declare read-only permissions, but one workflow lacks top-level permissions and three declare top-level write permissions. The mixed configuration increases the need for workflow-specific review, though it is not by itself evidence of unsafe behavior.