janczakb/filament-flex-fields

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These increase installation and update sensitivity, even though the signal does not show that the scripts are dangerous.

Project backingcaution

The package and repository are owned by the same individual account, and the repository is not organization-backed. This makes the strong activity more dependent on one maintainer.

Release historycaution

There have been 67 releases in 94 days, with releases roughly every 1.6 hours at the median. This shows active maintenance but also unusually rapid release churn that warrants version pinning and update review.

Repo bus factorcaution

Two contributors were active, but the primary contributor made 95 of 96 recent commits. Because the repository is user-owned rather than organization-owned, this concentration is a real continuity risk.

Token permissionscaution

The only workflow lacks top-level token permissions. No write permission is explicitly declared, but the absence of an explicit restrictive policy is a workflow-hardening gap.