netbull/media-bundle

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanner lowers repository hygiene somewhat, while the existing build tooling supports reproducible project maintenance.

Security policycaution

The repository has no SECURITY.md policy. This is a transparency gap for a media bundle handling files and access controls, though it is not evidence of abandonment by itself.

Workflow auditcaution

All 10 analyzed action references are unpinned, one release workflow has top-level write permissions, and a high-confidence finding shows a package installed outside a lockfile. No untrusted checkout or script-injection path was found, so these are workflow hygiene concerns rather than a severe risk.