wotz/filament-media-library

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which requires elevated trust, but no untrusted checkout or script-injection patterns were detected in the analyzed workflows.

Repo popularitycaution

The repository has 18 stars and 2 forks, so external adoption appears modest. This is only supporting evidence and is outweighed by the active release and contributor history.

Security policycaution

The repository has no SECURITY.md or equivalent security policy, leaving vulnerability reporting and response expectations less transparent.

Token permissionscaution

Three workflows declare top-level write permissions and two declare no top-level permissions, which is weaker workflow hardening than a consistently least-privilege setup.