artisanpack-ui/pagespeed-insights

Release historycaution

This is a very new package, released only once and 43 days ago, so there is little release history to establish long-term maintenance consistency.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported. The missing scanner is a transparency and hygiene gap, not evidence of unsafe code by itself.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures unclear.

Workflow auditcaution

Both workflows use read-only permissions and the audit completed fully with no untrusted checkout or script-injection findings. However, all 13 action references are unpinned; the cache-poisoning findings are low-confidence hygiene warnings, so this lowers confidence in build reproducibility but is not a severe risk alone.