hydrat/grogu-cms

Dependency profilecaution

Thirty runtime dependencies create a broad maintenance and compatibility surface, which is a modest concern for a CMS package with many integrations.

Lifecycle scriptscaution

The package runs a post-autoload-dump install lifecycle script. This is not inherently unsafe, but it adds install-time behavior that should be understood before adoption.

Repo bus factorcaution

Two contributors were active, but the top contributor made 82% of recent commits. The organization backing provides some handoff capacity, so this is only a modest concentration concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a transparency and detection gap.

Workflow auditcaution

All three workflows were analyzed with no audit findings, untrusted checkouts, or script injections. However, all eight action references are unpinned and two workflows grant top-level write permissions, creating a hygiene concern.