digedag/dfbsync

Lifecycle scriptscaution

A post-autoload-dump lifecycle script runs during installation. This is an additional execution surface, but the signal does not show that the script performs unsafe actions.

Repo bus factorcaution

All three recent commits came from one contributor, so maintenance knowledge and release capacity are concentrated in a single person.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool is configured. That is a transparency and maintenance-hygiene gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous sinks or audit findings, but all six action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions leave the build exposed to reference changes.