drevops/behat-screenshot

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because it runs in a privileged event context, although no untrusted checkout or script injection was detected.

Repo bus factorcaution

One contributor made 100% of the 27 recent commits, creating a real continuity risk; organization ownership provides some ability to hand maintenance to another contributor.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected; the missing scanner is a modest transparency gap rather than evidence of abandonment.

Token permissionscaution

Two of three workflows grant top-level write permissions, increasing the impact of a workflow compromise; the repository does declare permissions for every analyzed workflow.