digitalutsc/private_files_adapter

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, increasing installation-time behavior and maintenance risk compared with a package without lifecycle hooks. No provided signal shows these scripts are unsafe, so this is a hygiene concern rather than a severe risk.

Repo commit activitycaution

The repository had 0 commits and 0 active maintainers in the last three months, which raises a maintenance concern. The recent 1.0.0 release and documented contributions provide some counterweight but do not demonstrate continuing activity.

Security policycaution

The linked repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled. Organizational ownership and a recent release provide some backing but do not replace a published process.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but its only action use is unpinned. The absence of a top-level permissions block is acceptable on its own, while the unpinned action remains a modest supply-chain hygiene gap.