drevops/behat-phpserver

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants review because it can run with elevated repository context, although no untrusted checkout or script-injection pattern was detected.

Repo bus factorcaution

All 16 recent commits came from one contributor, creating concentration risk; organization backing partly compensates because maintenance can be handed off within the organization.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and assurance gap.

Token permissionscaution

All workflows declare top-level permissions, but two grant write access, increasing the impact of a workflow compromise compared with read-only permissions.