tomatophp/filament-locations

Dangerous workflowscaution

One workflow uses pull_request_target, but no untrusted checkouts or script injection were detected; the pattern warrants review because it can run with elevated repository context.

Dependency profilecaution

Six runtime dependencies are declared, including the target framework and related packages; this is a meaningful integration surface but not unusually large for a Filament plugin.

Maintainerscaution

Only one registry account has publish access, which creates a publishing concentration risk, although the organization-owned repository provides some backing and makes a short registry list less concerning.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although recent merged pull requests and a same-day push provide some counterevidence, this still indicates a meaningful short-term maintenance gap.

Token permissionscaution

Two of three workflows declare top-level write permissions and one has no top-level permissions declaration. This broadens CI credential exposure compared with least-privilege configuration.