pronamic/wp-pronamic-pay

Dependency profilecaution

The package declares 37 runtime dependencies spanning payment gateways and WordPress integrations. That breadth is appropriate for its plugin story but increases update and transitive-dependency maintenance exposure.

Lifecycle scriptscaution

Composer post-install-cmd and post-update-cmd scripts run during dependency operations. These are a supply-chain and installation-review consideration, although the active, structured package provides some compensating project context.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The build process is established, while automated security coverage is not evident.

Security policycaution

The linked repository has no security policy. This reduces disclosure transparency for a payment-related integration, although it does not by itself show abandonment or unsafe code.

Workflow auditcaution

All 4 workflows were analyzed successfully with no audited findings, no untrusted checkouts, no script injection, and no broad top-level write permissions. However, all 9 action references are unpinned, leaving avoidable action-supply-chain drift risk.