wotz/filament-translatable-tabs

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger has elevated workflow context. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Repo bus factorcaution

One contributor made all commits during the last three months, giving the project a single-person maintenance concentration. Organization backing provides some handoff capacity, but no second recent contributor is shown.

Repo commit activitycaution

There were 2 commits in the last three months, with one active maintainer. Activity is present but relatively light, so continued maintenance depends heavily on one person.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, although it does not by itself indicate abandonment or unsafe package behavior.

Token permissionscaution

Three workflows declare top-level write permissions and two declare no top-level permissions. The broad write settings and unspecified defaults reduce CI security transparency and should be reviewed before relying on the automation.