openeuropa/oe_link_lists

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts execute during dependency operations, which adds build and supply-chain exposure. The README explains that these hooks perform Drupal development-site setup and configuration preparation, partially contextualizing the behavior but not removing the need for review.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected. Build reproducibility is supported, while security automation coverage is a hygiene gap.

Security policycaution

No repository security policy was found. This reduces vulnerability-reporting transparency, although it is not evidence that the package is unmaintained.

Token permissionscaution

The one workflow has no top-level permissions declaration, so its GitHub token scope is not explicitly minimized. No top-level write permissions were detected, but the missing declaration remains a CI hardening gap.