openeuropa/oe_content

Lifecycle scriptscaution

The package uses post-install and post-update Composer scripts. These add install-time behavior that deserves review, but this signal alone does not show unsafe or unusual actions.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected. This is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although active commits, releases, and organization ownership partly compensate.

Workflow auditcaution

The only workflow was fully analyzed with no audit findings or untrusted checkout and script-injection issues. Its one action is unpinned, a minor reproducibility and supply-chain hygiene gap; the absent top-level permissions block is acceptable on its own.