api-platform/graphql

Dangerous workflowscaution

One workflow uses pull_request_target, which deserves review because it can run with elevated repository context, but there is no detected untrusted checkout or script injection.

Repo bus factorcaution

One contributor made 87.5% of the 16 recent commits, creating concentration risk; the second active contributor and organization ownership partly compensate, so this is a manageable caution rather than a severe abandonment signal.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; this is a modest transparency gap rather than evidence that the package is unsafe.

Token permissionscaution

The analyzed workflow has no top-level token permissions declaration. No write permissions were explicitly requested, but the absence of a restrictive declaration leaves unnecessary ambiguity.