maartenpaauw/filament-cashier-billing-provider

Dangerous workflowscaution

One of four workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger can run with elevated repository context. No untrusted checkouts or script-injection patterns were detected.

Maintainerscaution

One registry publisher creates some bus-factor concern, but the matching personal repository and recent release activity provide compensating evidence.

Project backingcaution

The registry namespace and repository owner match, and the source is user-owned rather than organization-backed. This is consistent ownership evidence, though it does not provide organizational redundancy.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, despite a recent push and a current release; this is the clearest maintenance concern.

Repo issue activitycaution

There are no open issues or pull requests, and no issue or pull-request activity in the last month. This is not inherently negative, but it provides little evidence of active community support.