evolution-cms/installer

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts execute during dependency operations, which is relevant supply-chain and installation risk for a CLI installer; the package's stated bootstrapper behavior makes these scripts functionally expected, but they still warrant review.

Repo toolingcaution

The repository uses Make and Composer build tooling, but has no security-scanning tools. The missing scanning is a hardening gap rather than evidence of abandonment.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency for a package that performs installation and release-related operations.

Token permissionscaution

The release workflow declares top-level write permissions. Although this enables publishing automation, broad write capability increases the impact of a workflow compromise and is a supply-chain hardening concern.