apache-solr-for-typo3/tika

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script runs during Composer operations. This is not evidence of harm by itself, but it adds execution surface during installation.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent despite otherwise active maintenance.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkout or script-injection trigger, so the high-confidence template-injection finding is workflow hygiene rather than a demonstrated severe path. However, all 8 action references are unpinned, which weakens build reproducibility, and the low-confidence cache-poisoning finding adds a smaller concern.