team-nifty-gmbh/flux-dev-helpers

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is a relevant execution surface and adds some supply-chain exposure, although the signal does not show that the script is unsafe.

Repo bus factorcaution

All three recent commits came from one contributor. Organization ownership offers some handoff capacity, but no second active contributor is evidenced.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a gap in the project's independent security checks.

Security policycaution

The repository has no security policy, which reduces transparency about vulnerability reporting and maintenance response.

Workflow auditcaution

The only workflow was fully analyzed, uses read-only permissions, and has no high-confidence findings. However, both of its two action references are unpinned, reducing build reproducibility.