pdir/social-feed-bundle

Licensecaution

The release declares LGPL-3.0-or-later and includes license files, but artifact detection also found CC-BY-4.0, OFL-1.1, and MIT content beyond that declaration. The additional component licenses warrant a small transparency caution.

Repo issue activitycaution

There are 22 open issues and no new issues closed in the last month, although one pull request was merged. The backlog is worth noting but does not outweigh the recent release and commit activity.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected. The missing scanner is a hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. For an extension that connects to several social platforms, this reduces vulnerability-reporting transparency.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but all 4 action references are unpinned. The clean audit offsets trigger and permission concerns, while unpinned actions remain a supply-chain hygiene gap.