spring-security-taglibs

Repo bus factorcaution

One contributor made about 77% of recent commits, creating concentration risk, although seven other contributors were active and organization backing provides some handoff capacity.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating a caution that the artifact-to-repository link is not explicit; the organization-owned Spring repository makes a monorepo explanation plausible but does not remove the gap.

Version stabilitycaution

The assessed version is a prerelease milestone, so compatibility may change before a stable release even though the major line is established.

Workflow auditcaution

All 12 workflows were analyzed, all 28 action references are pinned, and most workflows use read-only permissions. However, the audit found a high-confidence template-injection issue and several high-confidence secrets-inherit findings, while four workflows have top-level write permissions.