kirschbaum-development/redactor

Dangerous workflowscaution

One of six workflows uses pull_request_target, but there are no untrusted checkouts or script-injection findings. The isolated elevated-trigger workflow is worth review but is not severe on this evidence.

Lifecycle scriptscaution

The package runs post-autoload-dump and post-install-cmd scripts during installation. Install-time execution increases review and reproducibility concerns, even though no stronger evidence here indicates that the scripts are unsafe.

Release historycaution

This package is 452 days old but has only two releases, with one release in the last 12 months and a median interval of about 452 days. That is a thin release record for judging long-term maintenance.

Repo commit activitycaution

The repository has zero commits and zero active maintainers in the last three months. Although seven pull requests were merged in the last month, the absent commit activity still weakens evidence of sustained maintenance.

Security policycaution

The repository has no security policy. For a package designed to redact sensitive data, the absence of documented vulnerability-reporting guidance is a meaningful transparency gap.