easy-stack

Project backingcaution

The repository is owned by an individual account rather than an organization, so the small maintainer base has less institutional backing to absorb a handoff.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, though it is not evidence of unsafe code by itself.

Workflow auditcaution

All 20 analyzed action references are pinned, but the pages workflow combines a workflow_run trigger with an untrusted checkout, and two workflows grant top-level write permissions. The audit also found high-confidence low-severity ad hoc package installs in CI and publishing workflows, so workflow hygiene warrants caution.