logicbrush/silverstripe-imagegallery

Dangerous workflowsdanger

One of the two analyzed workflows contains a script-injection pattern. This is a concrete CI supply-chain concern that warrants workflow review before trusting repository automation.

Release historycaution

There have been six releases over about 3 years, but none in the last 12 months; the latest registry release was about 18 months before collection. This indicates reduced maintenance momentum.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push date is compensating evidence that the repository is not abandoned outright, but it does not show ongoing development.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small package this is a hygiene gap rather than evidence that the release is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.