humanmade/hm-carousel-block

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, so users lack a documented process for reporting vulnerabilities or understanding security handling.

Workflow auditcaution

Both workflows were analyzed completely and all three action references are pinned, with no untrusted checkout or script-injection path. However, the release workflow has five high-confidence template-injection findings, which are workflow hygiene concerns even without a corroborating dangerous trigger.