inisiatif/distribution-financings

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time lifecycle script. This adds some installation complexity, but the signal provides no evidence that the script is unsafe or unusually broad.

Security policycaution

The repository has no security policy. That is a transparency gap for reporting and handling vulnerabilities, although active tooling and organization backing partly compensate.

Workflow auditcaution

All four workflows were analyzed, but all 10 action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. One workflow also grants top-level write permissions; the pull_request_target trigger has no untrusted checkout or script-injection sink.