plugin/yard-warden

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts. These add install-time behavior that should be understood by consumers, but the signal does not show that the scripts are unsafe or unusually complex.

Release historycaution

The package is only 45 days old, with seven releases and a median release interval of 0 days. This shows active early development but provides limited evidence of long-term stability.

Repo bus factorcaution

One contributor made 22 of 24 recent commits, leaving maintenance highly concentrated. Organization ownership provides some handoff capacity, but the signal does not show a second active human contributor at a comparable level.

Security policycaution

The repository has no security policy. For a plugin focused on authentication and password security, the absence of a documented vulnerability-reporting path is a meaningful transparency gap.

Workflow auditcaution

All five workflows were analyzed, with no untrusted checkouts or script injection, but four high-confidence medium-severity secrets-inherit findings expose reusable workflows to broader credentials, and all eight action references are unpinned. These are workflow-hardening concerns rather than evidence of an unsafe release by themselves.