team-nifty-gmbh/flux-erp

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because it can run with elevated repository context, but no untrusted checkouts or script-injection patterns were detected.

Dependency profilecaution

The package has 32 runtime dependencies, including significant Laravel, database, search, mail, and UI integrations; this is substantial complexity but consistent with a full ERP package rather than an unexplained dependency load.

Repo bus factorcaution

One contributor made about 93% of the 389 recent commits, creating a real continuity risk; three additional contributors were active, and organization ownership provides some ability to hand maintenance off.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance undocumented for a package with substantial application functionality.

Token permissionscaution

Three workflows request top-level write permissions and two omit top-level permissions, which is broader or less explicit than ideal for CI safety; the remaining workflows include read-only or job-level permissions.