mokhosh/filament-jalali

Lifecycle scriptscaution

The package uses a post-autoload-dump lifecycle script. This is a real installation-time behavior that deserves attention, but the signal does not show that it performs unsafe actions.

Project backingcaution

The repository and registry are owned by the same individual, so there is no organization-level handoff capacity shown. This is partly offset by two recent active repository contributors.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a transparency and defense-in-depth gap, not evidence of an unsafe release by itself.

Security policycaution

The repository has no security policy. This weakens the project’s documented process for reporting and handling vulnerabilities, though it does not indicate abandonment.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but all eight action references are unpinned and two workflows grant top-level write access. These are meaningful automation hygiene weaknesses without a demonstrated exploit path.