lonnieezell/codeigniter-shield

Lifecycle scriptscaution

A post-update command runs during dependency updates. Its behavior is not shown here, so this is a modest supply-chain and installation-review concern rather than a severe risk.

Repo package mentioncaution

The repository name does not match the registry package name and its README does not mention the package, creating a transparency concern about the package-to-repository link. Organizational backing and the repository's CodeIgniter Shield content partly compensate, but the mismatch remains worth verifying.

Workflow auditcaution

All 13 workflows were analyzed with no failed files, untrusted checkouts, or script-injection findings; most action references are pinned, though 8 of 22 are unpinned. Four high-confidence template-injection findings in docs.yml and one workflow with top-level write permissions warrant review, but no dangerous trigger or untrusted sink was reported.