altis/core

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because it can run with elevated repository context; however, no untrusted checkouts or script-injection patterns were detected.

Dependency profilecaution

The release has five runtime dependencies, including the PHP and Composer interfaces plus AWS SDK and analytics libraries; this is a meaningful but not unusually broad dependency surface.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear for consumers and maintainers.

Token permissionscaution

Three of four workflows lack top-level permission declarations, and one backport workflow grants top-level write access; this is weaker workflow hardening than preferred.