wotz/filament-belongs-to-many

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown to offset the concentration.

Repo commit activitycaution

Only one commit was recorded in the last three months, which is thin activity for an actively released package and leaves less evidence of sustained maintenance.

Security policycaution

The repository has no security policy, leaving reporting and response expectations less transparent for users of this integration package.

Workflow auditcaution

All 16 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue; two workflows also grant top-level write access. The pull_request_target workflow has no untrusted checkout or script-injection finding, so this is a hygiene and maintenance concern rather than a severe standalone risk.