cmsmaxinc/filament-system-versions

Lifecycle scriptscaution

A post-autoload-dump install-time script adds execution during dependency installation, creating a modest operational and review concern even though this does not establish malicious behavior.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and preventive-hygiene gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are less transparent for adopters.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings or untrusted checkout and injection sinks. However, all 5 action references are unpinned, and one workflow grants top-level write permissions, creating a moderate workflow-hygiene concern.