concretecms-community-store/community_store

Repo bus factorcaution

All 15 commits in the last three months came from one contributor, creating a meaningful continuity risk. The organization-owned repository provides some ability to hand maintenance off, but no second recent contributor is shown.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools are configured. The missing scanning reduces assurance but is not by itself evidence that the release is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented for a package that handles ecommerce functionality.

Token permissionscaution

None of the three workflows declares top-level token permissions. Although no workflow is shown requesting top-level write access, the absence of explicit restrictions is a repository hygiene weakness.