digitick/sepa-xml

Dangerous workflowscaution

One of six workflows uses pull_request_target, which warrants review because it can run with elevated repository context. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Repo bus factorcaution

One contributor made 75% of the 4 recent commits, creating some concentration risk. However, a second contributor remains active and the repository is organization-owned, which provides some handoff capacity.

Token permissionscaution

All six workflows declare permissions, and three use read-only permissions. Three workflows request top-level write access, which is broader than ideal but is explicit rather than uncontrolled.