wotz/filament-admin-bar

Dangerous workflowscaution

Five workflows were analyzed with no untrusted checkout or script-injection findings, but one pull_request_target workflow is used for automated Dependabot merging. This deserves review because that workflow class can carry elevated privileges.

Repo bus factorcaution

All recent commits came from one contributor, with a 100% commit share. Organizational ownership provides some handoff capacity, but no second active contributor is shown to reduce the immediate bus-factor risk.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, indicating limited recent development activity despite the recent release history. This is a maintenance caution, not abandonment evidence by itself.

Security policycaution

No security policy is present in the repository. That weakens vulnerability-reporting transparency, although it is not evidence that the package is unsafe or abandoned.

Token permissionscaution

Three workflows lack top-level token permissions and two declare write access. Broad or implicit permissions increase workflow-maintenance risk even though no untrusted checkout or script injection was detected.