jeffersongoncalves/filament-oidc

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script; this is a normal Composer integration point, though it adds install-time behavior to review.

Maintainerscaution

Only one registry account has publish access, which creates release-account concentration; repository activity from three active contributors partly offsets that publishing risk.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer and concentrated ownership provide less institutional backup.

Security policycaution

No SECURITY.md policy was found, leaving vulnerability-reporting expectations unclear for an authentication-related plugin.

Workflow auditcaution

All five workflows were analyzed, all 12 action references are pinned, and no untrusted checkout or script injection was found. However, a high-confidence bot-conditions finding affects Dependabot auto-merge, and two workflows grant top-level write permissions, so automation hygiene is a caution.