tapp/filament-forum

Lifecycle scriptscaution

The package defines a post-autoload-dump lifecycle script. Install-time execution adds some operational exposure, but this signal does not show that the script is unsafe or unusually broad.

Repo bus factorcaution

Two contributors were active recently, but the leading contributor made 75% of commits. The second contributor and organization ownership partly compensate for the concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. That leaves a supply-chain hygiene gap without evidence of an unsafe build.

Workflow auditcaution

All 12 analyzed action references are unpinned, and two workflows grant top-level write permissions. The audit also found one high-confidence bot-conditions issue in the Dependabot auto-merge workflow; the pull_request_target trigger alone is ordinary, but these workflow weaknesses warrant attention.