chiiya/filament-access-control

Dangerous workflowscaution

One of three workflows uses pull_request_target, creating elevated workflow-risk potential, but no untrusted checkout or script-injection patterns were detected.

Project backingcaution

The registry namespace and repository owner are the same individual account, which provides direct ownership alignment. A single-user project has less organizational redundancy than an organization-backed project.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months. This is a meaningful maintenance warning, although the recent 2.9.0 release and repository push provide compensating evidence that the project has not been abandoned.

Repo issue activitycaution

The repository has only one open issue and one open pull request, with no new or merged items in the last month. The low backlog is positive, but the absence of recent issue or pull-request movement offers little evidence of ongoing responsiveness.

Token permissionscaution

Two workflows omit top-level permissions and one declares top-level write access. These settings reduce workflow transparency and least-privilege assurance, though they do not by themselves show a malicious workflow.