ernestdefoe/hero-builder

Maintainerscaution

Registry publishing access is held by one maintainer, which creates some continuity risk for an individually owned package. Recent repository activity from two contributors partly offsets that concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational handoff capacity to offset the single registry maintainer. The two active recent contributors provide partial practical support.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tool was detected. The missing scanner is a modest hygiene gap rather than evidence of abandonment or unsafe code.

Security policycaution

No repository security policy was found. For an extension with repository workflows and published releases, this reduces transparency modestly but does not by itself make the release unfit.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, audit findings, or unpinned actions. One workflow grants top-level write permissions, a mild hygiene concern, but no untrusted path was found to reach those permissions.