A documented security policy and release notes improve transparency. The workflow audit found no dangerous patterns, though all three action references are unpinned.
80%
Total Score
83
100
94
75
Only 2 commits from 1 active maintainer occurred in the last 3 months, indicating limited recent development, though the release history shows ongoing publishing.
Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.
All three workflows were analyzed with no dangerous triggers, injection findings, or other audit findings. However, all 3 of 3 action references are unpinned, which weakens build reproducibility.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-32265 craftcms/aws-s3 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 2.0.2 - 2.2.4. | 2.0.2 - 2.2.4 | Medium |
AIKIDO-2026-10273 craftcms/aws-s3 is vulnerable to Information Disclosure in versions 1.0.0 - 2.2.4. | 1.0.0 - 2.2.4 | Low |
| Dependency | Last Release | Score |
|---|---|---|
craftcms/cms Version ^4.0.0-beta.1|^5.0.0-beta.1 | — | — |
craftcms/flysystem Version ^1.0.0-beta.2|^2.0.0 | — | — |
league/flysystem-aws-s3-v3 Version ^3.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.