mydnic/volet-feedback-messages-filament-plugin

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. The recent June release partly offsets this, but the quiet period is a genuine maintenance concern.

Security policycaution

The repository has no security policy. For a small plugin this is a transparency and reporting gap, but it is not severe enough to make the release unfit on its own.

Workflow auditcaution

All 7 action references are unpinned and all three workflows grant top-level write permissions; the audit also found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. No untrusted checkout or script injection was found, so this is workflow hygiene risk rather than a severe standalone dependency risk.