dkd/content-signals

Release historycaution

This is the only release, published about 221 days ago, so there is little release history from which to judge sustained maintenance. The project is still relatively young, which partly limits how strongly this weighs against it.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Because the release is young and there is only one release, this indicates uncertain follow-through rather than clear abandonment.

Repo toolingcaution

Composer is used for the build, but no security-scanning tool is configured. This is a modest transparency and maintenance gap, not evidence that the release is unsafe by itself.

Security policycaution

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. For an extension that changes page output, this is a real but limited maintenance gap.

Workflow auditcaution

The sole workflow was fully analyzed without dangerous triggers, untrusted checkouts, or audit findings. However, both of its two action references are unpinned, which weakens build reproducibility and supply-chain hygiene.