dotsunited/wordpress-boilerplate

Lifecycle scriptscaution

The post-create-project-cmd script runs during project creation, adding execution behavior beyond ordinary dependency installation; this is relevant because the package is a project scaffold.

Repo bus factorcaution

All 22 recent commits came from one contributor, leaving maintenance capacity concentrated despite the repository's organization ownership.

Security policycaution

The repository has no security policy. This is a transparency gap for a project scaffold that includes deployment and Docker workflows, though it is not evidence of an unsafe release by itself.

Workflow auditcaution

Both workflows were fully analyzed without untrusted triggers, injection findings, or write-permission findings, and jobs scope permissions. However, all 10 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.