gosuperscript/filament-alert-component

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, which increases automation exposure, although no untrusted checkout or script-injection patterns were detected.

Maintainerscaution

Only one account has registry publish access, which creates a narrow publishing path; the organization-owned repository provides some backing but does not remove the single-publisher concentration.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, a concrete sign that maintenance has recently stalled despite the repository not being archived.

Repo issue activitycaution

There are six open pull requests with no merges in the last month and no new issue activity, suggesting changes may be waiting for maintainer attention.

Token permissionscaution

Three workflows request top-level write permissions and two declare no top-level permissions, leaving broader-than-necessary or unclear token access in part of the CI configuration.