froala/craft-froala-wysiwyg

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no published security policy, making vulnerability reporting and response expectations less clear.

Workflow auditcaution

Both workflows have high-confidence template-injection findings, all three action references are unpinned, and both workflows grant top-level write permissions. No untrusted checkout or dangerous trigger was reported, so this is a significant hygiene concern rather than a standalone severe risk.