jorisnoo/craft-sidebar-relations

Release historycaution

The package is 131 days old and has only one release, so its long-term maintenance record is not established. The repository has since received commits, which partly offsets the limited registry history.

Repo toolingcaution

The repository uses Just and Composer build tooling, but no security-scanning tool was detected. That is a modest process gap for a new package.

Security policycaution

No repository security policy was found, leaving no documented route for reporting vulnerabilities or describing security handling.

Workflow auditcaution

Both workflows grant top-level write permissions, and the sole action reference is unpinned, creating workflow-hygiene concerns. The pull_request_target workflow has no untrusted checkout or script-injection sink, while the high-confidence bot-condition and template-injection findings remain issues to review rather than standalone proof of severe risk.