goldnead/statamic-marketing

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest assurance gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy. For a package handling mailing lists, consent, campaigns, and tracking, the missing disclosure and response process is a real transparency gap, although active development and repository tests partly reduce abandonment concerns.

Workflow auditcaution

All four workflows were analyzed, use read-only permissions, and had no injection or high-severity findings. However, all 23 action references are unpinned, leaving builds exposed to changing upstream action code and making this a hygiene gap.