timo-de-winter/filament-modifiable-plugins

Workflow auditdanger

All 9 action references are unpinned, two workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The audit was complete, but these issues weaken build and release hygiene.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which adds execution during installation and warrants some caution even though this is a common Composer lifecycle hook.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, despite a release on September 17, leaving current maintenance capacity unclear.

Security policycaution

The linked repository has no published security policy, reducing transparency about vulnerability reporting and response.