publishpress/wordpress-edd-license

Licensecaution

The artifact includes license files and declares GPL-2.0-or-later, but the detected GPL-2.0 text is narrower than the declaration, creating a licensing inconsistency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although the package had a release in May 2026 and a repository push in June 2026.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting less transparent for a library used in WordPress plugins.

Workflow auditcaution

The sole workflow grants top-level write permissions, uses one unpinned action, and has a high-confidence medium-severity secrets-inherit finding. No untrusted checkout or script injection was detected, so this is a hygiene concern rather than a severe workflow risk.