jazzman/wp-performance

Maintainerscaution

Only one registry account has publish access. This is a limited publishing base, although repository activity shows that the same owner is actively maintaining the project.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 23 recent commits came from one contributor, leaving maintenance highly concentrated and creating a meaningful continuity risk.

Security policycaution

No repository security policy was found. This is a transparency gap for a plugin whose README describes security hardening, though active scanning provides some compensation.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkout or script-injection findings, but all six action references are unpinned and one workflow uses a top-level write token. A high-confidence medium-severity archived action also remains in the release workflow.