duckdev/freemius-plugin-licensing

Registry deprecationdanger

Packagist marks the entire package as abandoned and names foxelabs/wp-freemius-client as its replacement, so new dependents should not adopt this release.

Repo bus factorcaution

All 5 commits in the last 3 months came from one contributor, creating a thin operational base; organization ownership provides some handoff capacity but does not remove the concentration.

Repo toolingcaution

Composer build tooling is present, but no security scanning tooling was observed, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, making vulnerability reporting and handling less transparent.

Workflow auditcaution

All 8 action references are unpinned and the workflow grants top-level write permissions. The two cache-poisoning findings are low-confidence, so they are hygiene concerns rather than strong evidence of a severe workflow risk.