citation-media/wp-webhook-framework

Repo bus factorcaution

One contributor made all recent commits, leaving maintenance dependent on a single person with no demonstrated handoff capacity.

Repo commit activitycaution

The repository had 3 commits in the last 3 months, so work is still occurring, though the volume is modest.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving dependency and build-risk checks less visible.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less transparent for a package that handles webhook delivery.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, or audit findings. However, all 12 action references are unpinned, which weakens build reproducibility and supply-chain controls; the absence of top-level permissions is acceptable on its own.