chesio/bc-security

Maintainerscaution

Only one registry account has publish access, which creates a thin publishing base; the linked repository is also owned by an individual rather than an organization.

Repo commit activitycaution

The repository shows zero commits and zero active maintainers in the last three months, a meaningful maintenance concern even though its release history and recent push date provide some counterevidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest security-process gap for a security-focused WordPress plugin.

Security policycaution

The repository has no security policy, which reduces transparency about vulnerability reporting and handling for a package whose purpose is website security.

Workflow auditcaution

The single analyzed workflow has no untrusted trigger or audit finding, but all 15 action references are unpinned. The missing top-level permissions block is acceptable on its own and is not a severe issue here.