restruct/silverstripe-shortcodable

Licensecaution

The artifact contains a license file and the repository also has one, but the detected MIT license does not match the manifest's BSD-3-Clause declaration. That inconsistency reduces transparency and merits verification before adoption.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Frequent registry releases partly offset this, but the lack of recent source activity is still a maintenance caution.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools were detected. The absence is a modest transparency and maintenance gap, not evidence of unsafe code by itself.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although it does not by itself indicate abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or untrusted sinks, but all four action references are unpinned. That leaves avoidable supply-chain drift risk in CI.