digitonic/filament-rich-editor-tools

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a meaningful integration surface that deserves review, although the signal does not show a dangerous script by itself.

Repo commit activitycaution

The repository records zero commits and zero active maintainers over the last 3 months. That is a maintenance concern for a package whose recent release cadence had previously been frequent.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and assurance gap rather than evidence that the package is unsafe.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Token permissionscaution

The sole GitHub Actions workflow has no top-level token permissions declaration. Although no write permissions or dangerous workflow patterns were detected, explicitly limiting permissions would be better practice.