alexandergabriel/filament-oauth2

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during installation. This is an additional execution surface, though the signal does not show that the script is unsafe.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

All seven recent commits came from one contributor, leaving no demonstrated second maintainer to provide continuity if that person becomes unavailable.

Workflow auditcaution

Both workflows use top-level write permissions and all four action references are unpinned; the audit also found a high-confidence bot-condition issue in a pull_request_target workflow. No untrusted checkout or script-injection sink was detected, which limits the severity.