localgovdrupal/localgov_content_access_control

Release historydanger

This is the package's only release, published nearly 2 years and 10 months ago, with no releases in the last 12 months. That weakens confidence in ongoing maintenance despite the repository being updated later.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, though it is partly offset by the repository's organization backing.

Workflow auditcaution

The sole workflow has a high-confidence template-injection finding and all 10 action uses are unpinned. It has no untrusted checkout or dangerous trigger, so these are material hygiene and supply-chain concerns rather than a critical risk on their own.