keleo/custom-css-bundle

Release historycaution

The latest registry release was about 2 years and 4 months ago, with no releases in the last 12 months; this raises maintenance risk, although the project has 17 releases overall.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, which weakens evidence of ongoing maintenance despite the repository's more recent push timestamp.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap, not evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a real transparency gap for a web application plugin.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but both of its action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own.