johannschopplich/kirby-locked-pages

Repo bus factorcaution

One contributor made all 24 commits in the last three months, so continuity depends heavily on a single person. The directly matching repository and active release history provide some compensation, but not full redundancy.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. For a plugin handling password protection, that is a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy. This is a modest gap for a package that handles authentication-related behavior, though active maintenance and release notes provide some compensating evidence.

Workflow auditcaution

The only workflow was fully analyzed with no untrusted checkout or script-injection path, but all three action references are unpinned and the workflow uses top-level write permissions. The low-confidence cache-poisoning finding is hygiene rather than a standalone severe risk.