jeffersongoncalves/servicedeskkitv3

Lifecycle scriptscaution

The package uses four install and update lifecycle scripts, which increases installation complexity and deserves attention for an application starter kit, but the signal alone does not show unsafe behavior.

Project backingcaution

The package and repository are owned by the same individual account, so there is no organizational handoff or institutional backing to offset the small maintainer base.

Repo bus factorcaution

Two contributors were active, but the top contributor made about 65% of recent commits. The second contributor's substantial activity partly offsets the concentration, leaving a modest continuity concern.

Workflow auditcaution

All four workflows were analyzed and all ten action references are pinned, but the auditor found one high-confidence, high-severity template-injection issue in update-changelog.yml. One workflow also grants top-level write access, increasing the importance of correcting the finding.