statikbe/laravel-filament-flexible-blocks-asset-manager

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that event has elevated trust; no untrusted checkout or script-injection patterns were detected.

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script increases execution complexity during installation and merits review, though this is not severe by itself.

Repo bus factorcaution

One contributor made all four commits in the last 3 months, creating a genuine bus-factor concern. Organization ownership partially mitigates this, but no second active contributor is shown.

Token permissionscaution

Three workflows declare top-level write permissions and two omit top-level permissions, indicating weaker least-privilege hygiene than read-only or narrowly scoped workflow permissions.