coringawc/filament-action-approvals

Workflow auditdanger

All 12 action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; three workflows also grant top-level write access. The pull_request_target workflow has no untrusted checkout or script-injection findings, which limits the severity.

Lifecycle scriptscaution

A post-autoload-dump install script is present, which adds installation-time behavior and modest supply-chain exposure, but this alone is not evidence of unsafe or excessive behavior.

Repo bus factorcaution

All 8 recent commits came from one contributor, leaving maintenance continuity dependent on a single person with no provided organizational backing.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a transparency and defensive-maintenance gap.

Security policycaution

The repository has no security policy, so users are given no documented route for reporting vulnerabilities or understanding the project's security process.