capell-app/content-sections

Workflow auditdanger

The sole workflow combines pull_request_target with an untrusted checkout and top-level write permissions, creating a meaningful risk if untrusted pull-request code reaches privileged steps. Both referenced actions are also unpinned.

Licensecaution

The manifest declares a proprietary license and no license file was found. This creates a real transparency and reuse concern for an open-source dependency.

Repo bus factorcaution

All 17 recent commits came from one contributor. Organization backing provides some handoff capacity, but recent maintenance remains highly concentrated.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest process gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although it is not by itself a dependency-blocking issue.