lindemannrock/craft-shortlink-manager

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which add execution during dependency operations and warrant some supply-chain caution even though no malicious verdict is implied.

Repo bus factorcaution

All 46 recent commits came from one contributor, creating a meaningful continuity risk; the organization-owned repository partly compensates by providing project backing.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest process gap for a plugin with substantial application functionality.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkout/script-injection sinks. However, all 6 action references are unpinned and 2 workflows grant top-level write permissions, creating workflow hygiene and token-scope caution.