nitsan/ns-disqus-comments

Licensecaution

The manifest declares GPL-2.0+, while the detected LICENSE file says GPL-3.0; although both the artifact and repository include a license file, this unresolved mismatch reduces clarity for adopters.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. This is a meaningful maintenance warning, although the recent registry release and repository push provide some contrary evidence.

Repo toolingcaution

Composer is used for the build, but no security-scanning tool was detected. The missing scanner is a hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations unclear for a package integrated into websites.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. Its one action is unpinned, which weakens build reproducibility, while the absent top-level permissions block is acceptable on its own.