3brs/sylius-enterprise-security-plugin

Lifecycle scriptscaution

Composer runs post-create, post-install, and post-update scripts. Install-time scripts can affect dependency installation and deserve review, although this signal alone does not show harmful behavior.

Release historycaution

This package is brand new, with one release published today and no established release cadence. The active repository partly offsets the limited registry history, but version maturity remains unproven.

Repo toolingcaution

The project uses Composer and Make, but no security scanning tools were detected. That is a modest transparency and maintenance gap for a security-focused plugin.

Security policycaution

No repository security policy was found. For a plugin covering authentication, passkeys, OAuth, and account protection, the absence of a documented vulnerability-reporting path is a real transparency gap.

Workflow auditcaution

CI analyzed completely and has no untrusted checkout or script-injection findings, but all six action references are unpinned and two high-confidence checks install packages outside a lockfile. These are workflow hygiene and reproducibility concerns, not severe risks on their own.