cu-boulder/ucb_d9_custom_entities

Licensecaution

The artifact declares MIT but its LICENSE file was detected as GPL-2.0, creating a material licensing ambiguity despite a license file being present.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent even though the repository content appears related to custom entities.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less clear.

Workflow auditcaution

All five workflows were analyzed without untrusted checkouts or script injection, but all five uses are unpinned and one high-confidence medium-severity finding shows secrets inherited by a reusable workflow. Missing top-level permissions blocks are acceptable on their own.