1994/ghostwriter-statamic

Release historycaution

The package was first released less than a day ago and has five releases in that period. This shows active initial publishing but provides almost no evidence of sustained maintenance yet.

Repo commit activitycaution

No commits or active maintainers were recorded during the last three months, which weakens evidence of ongoing maintenance. The repository was nevertheless pushed recently and merged 42 pull requests in the last month, so this is a concern about historical coverage rather than clear abandonment.

Repo toolingcaution

The repository uses Composer, but no security scanning tool was detected. That is a modest transparency and maintenance gap, not evidence that the code is unsafe.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear for a package that handles external provider credentials and content workflows.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkouts, injection findings, or other audit findings. However, all five referenced actions are unpinned, so their exact build inputs are not fixed.