wotz/filament-placeholder-input

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script-injection pattern was detected, so this is a contained workflow caution rather than a severe risk.

Repo bus factorcaution

All recent commits come from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is evidenced in this period.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, from one active maintainer, which is a meaningful sign of limited recent maintenance capacity despite the recent release.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations less transparent; the README does provide an email contact, which partly compensates.

Token permissionscaution

Four workflows lack top-level permissions declarations, and one auto-merge workflow has top-level write access. Explicit least-privilege controls are therefore incomplete.