oro/platform-application

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations, adding execution-time supply-chain exposure even though lifecycle hooks are common in application packages.

Repo toolingcaution

Composer is used for builds, but no security-scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence of abandonment.

Security policycaution

The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting and response expectations unspecified.