solution-forest/filament-email-2fa

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, adding some execution surface for consumers, although this is a common Composer lifecycle hook.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which weakens evidence of ongoing maintenance despite the recent release.

Repo toolingcaution

Composer build tooling is present, but no repository security scanning tools were detected, leaving a security-process gap.

Workflow auditcaution

All 11 analyzed action references are unpinned, reducing build reproducibility and increasing exposure to action changes. Two workflows also grant top-level write permissions, but there are no untrusted checkouts, injection findings, or other audited high-confidence hazards.