capell-app/socials

Workflow auditdanger

The only workflow combines pull_request_target, an untrusted checkout, top-level write permissions, and two unpinned action references in the same file. Although the audit found no explicit injection finding, this combination creates a serious release-workflow exposure.

Release historycaution

The package is only 1 day old, despite 38 releases arriving in that period. This shows active initial development but provides little evidence of established release stability.

Security policycaution

The repository has no security policy, leaving no documented route for reporting vulnerabilities. This is a transparency gap, though it is less significant than the workflow exposure.

Version stabilitycaution

All recent releases are prereleases and the assessed version is v1.0.0-beta.40. That is appropriate for an early project but signals that interfaces and behavior may still change.