jeffersongoncalves/filakitv4

Dependency profilecaution

The package declares 17 runtime dependencies, including framework, UI, and security-related components, creating a broad dependency surface for a starter kit.

Lifecycle scriptscaution

Four Composer lifecycle scripts run during installation or updates, increasing install-time behavior and operational exposure compared with a package without scripts.

Project backingcaution

The package and repository are owned by the same individual account, so the matching ownership is transparent, but there is no organization backing shown to broaden maintenance capacity.

Repo bus factorcaution

Two contributors were active in the last three months, with the leading contributor responsible for about 61% of commits. This is a small but not single-person contributor base.

Workflow auditcaution

The audit analyzed all six workflows and found no untrusted checkout or script-injection paths, with all 15 action references pinned. However, it identified a high-confidence bot-conditions issue in the Dependabot auto-merge workflow, and three workflows grant top-level write permissions.