froala/wysiwyg-cake2

Licensecaution

The manifest declares a proprietary license while the artifact and repository contain an MIT license file. This mismatch should be clarified before depending on the release.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling was detected. This is a modest process gap rather than evidence of abandonment.

Security policycaution

The repository has no published security policy. That reduces vulnerability-reporting transparency, though the active project and release history provide some compensation.

Workflow auditcaution

Both workflows have high-confidence template-injection findings, and all 3 of 3 action references are unpinned. Top-level write permissions on both workflows add exposure, although no untrusted checkout or privileged trigger was reported.