setono/sylius-facebook-plugin

Workflow auditdanger

Both workflows use 27 unpinned actions, and the audit found one high-confidence template-injection issue; although no untrusted checkout or write-wide token trigger was reported, this remains a significant workflow hygiene and supply-chain concern.

Dependency profilecaution

The package declares 27 runtime dependencies across Sylius, Symfony, and Meta integrations, creating substantial compatibility surface; this is partly explained by its role as a Sylius plugin.

Repo bus factorcaution

All 14 recent commits came from one contributor, concentrating maintenance knowledge and increasing continuity risk; organization backing provides some handoff capacity but does not remove the concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest process gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response.