craftcms/cloud

Licensecaution

Neither the package nor the linked repository provides a recognized license declaration or license file. This is a real transparency and adoption concern, despite the otherwise well-documented project.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a modest assurance gap rather than evidence of abandonment or unsafe behavior by itself.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no detected high- or medium-confidence findings or untrusted execution sinks. However, all 3 referenced actions are unpinned, leaving a supply-chain hygiene gap.