happytodev/blogr-gdpr

Repo bus factorcaution

One contributor made all 8 commits in the last 3 months, giving the project a bus factor of one. The repository is user-owned rather than organization-owned, so there is no provided backing evidence to offset that concentration.

Repo commit activitycaution

The repository recorded 8 commits in the last 3 months, showing ongoing work. However, all activity is concentrated in one active maintainer, limiting resilience if that person stops maintaining it.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. This is a modest transparency gap for a plugin handling consent and personal-data workflows, not evidence of unsafe code.

Security policycaution

The repository has no security policy. For a GDPR-focused plugin that processes consent and data requests, the missing disclosure path modestly reduces maintenance and vulnerability-reporting transparency.

Workflow auditcaution

Both workflows were fully analyzed with no injection, untrusted-checkout, or audit findings, and they do not grant top-level write access. However, all 4 of 4 action references are unpinned, leaving build inputs less reproducible and increasing supply-chain hygiene risk.