inalto/filament-exposure-picker

Release historycaution

The package has had no releases in the last 12 months, despite a five-release history and a median interval of about 106 days; this indicates a meaningful maintenance slowdown.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, which raises concern about responsiveness and abandonment risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented; security scanning tools provide some compensation but do not replace a policy.

Workflow auditcaution

All 9 analyzed action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the severity.