setono/meta-conversions-api-bundle

Workflow auditdanger

Both workflows were analyzed without incomplete files, but all 21 action references are unpinned. More importantly, a high-confidence, high-severity template-injection finding may expand attacker-controlled input into code; the absence of dangerous trigger and untrusted-checkout counts does not compensate for that finding.

Dependency profilecaution

Fourteen runtime dependencies, including Symfony components and the related SDK, create meaningful compatibility surface for a beta bundle. The dependencies are coherent with the package's Symfony integration role rather than appearing excessive or unrelated.

Maintainerscaution

Only one registry account has publish access, which is a publishing continuity concern. However, the repository is organization-owned and recent repository activity shows active project backing.

Repo bus factorcaution

One contributor made all 27 commits in the last three months, creating a concentrated maintenance dependency. Organization ownership provides some handoff capacity, but no second active contributor is evidenced here.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a hygiene gap, not evidence of abandonment or unsafe code by itself.