inc2734/wp-awesome-widgets

Repo bus factorcaution

All five recent commits came from one contributor, giving the project a complete short-term concentration of maintenance work. The user-owned repository provides no organizational handoff evidence to offset that concentration.

Repo toolingcaution

The repository uses Composer for builds, which is appropriate, but no security-scanning tooling was detected. The missing scanner is a transparency and hygiene gap rather than evidence of unsafe code.

Security policycaution

No repository security policy was found. That leaves vulnerability-reporting expectations unclear and modestly reduces transparency for a library used in WordPress projects.

Workflow auditcaution

The sole workflow uses two unpinned actions, so all analyzed action references can change without a version pin. The low-confidence cache-poisoning finding is hygiene at most, because the audit did not establish a concrete exploitable path.