lwplugins/lw-scan

Release historycaution

The package is only 14 days old, with 13 releases and a median interval of about 10 hours. This shows active iteration but provides little evidence of long-term stability.

Repo bus factorcaution

One contributor made all 34 commits in the last three months. Organization ownership partly offsets this concentration, but no second active contributor is shown.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented for a security-focused WordPress scanner.

Workflow auditcaution

All 15 analyzed action references are unpinned, which weakens build reproducibility. The reported cache-poisoning finding has low confidence and is hygiene rather than a standalone severe risk.