tomatophp/filament-accounts

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which carries elevated workflow trust requirements, but no untrusted checkout or script-injection patterns were detected.

Release historycaution

Thirty releases over 879 days show an established project, but only two releases in the last year indicate a comparatively slow recent release cadence.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months. This is a meaningful maintenance concern, although the recent release, current push timestamp, and five merged pull requests provide partial compensating evidence.

Token permissionscaution

Two of three workflows declare top-level write permissions and one declares no top-level permissions. This broadens CI token authority and warrants review, though the signal does not show an exploitable workflow pattern.