vrana/adminer

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, which add install-time behavior that consumers should review. The scripts are not shown as dangerous, so this is a limited supply-chain hygiene concern rather than a severe risk.

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tool was detected. The missing scanner is a transparency and defense-in-depth gap, partially offset by the active repository and other workflow controls.

Token permissionscaution

The only workflow lacks top-level token permissions, so its effective permissions are not explicitly constrained in the workflow metadata. No write permissions were detected, but explicit least-privilege declarations would improve transparency.