gravitykit/gravityexport-lite

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no replacement given. Active repository work partly offsets abandonment risk but does not remove the registry warning.

Repo bus factorcaution

One contributor made about 79% of recent commits, creating concentration risk. Two additional contributors remain active and the repository is organization-owned, which partly compensates.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a maintained plugin, that is a meaningful transparency and risk-management gap.

Security policycaution

The repository has no security policy. This makes vulnerability reporting and response expectations less clear for a package handling exported form data.

Workflow auditcaution

All three workflows were analyzed without dangerous audit findings or broad top-level write permissions. However, all eight action references are unpinned, reducing build reproducibility and supply-chain hygiene.