blueways/bw-static-template

Licensecaution

The manifest declares MIT, but the artifact license file is detected as GPL-2.0; although a license file exists, the mismatch creates uncertainty about the terms consumers receive.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, a concrete sign that maintenance may have paused after the recent release.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; this is a modest supply-chain hygiene gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All 13 analyzed action references are unpinned, which weakens build reproducibility and update control. The pull_request_target workflow has no untrusted checkout or script-injection finding, and the absence of top-level permissions is not a problem by itself.