silverstripe/assets

Repo toolingcaution

Composer build tooling is present. No security scanning tools were detected, which is a minor transparency gap but not a standalone dependency risk.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear. This is a modest transparency concern for a maintained framework component.

Version stabilitycaution

This release is a prerelease candidate, which adds some adoption risk compared with a stable release. Recent prereleases account for 35% of releases, so this is a modest concern rather than evidence of instability across the project.

Workflow auditcaution

All six workflows were analyzed with no audit findings, five use read-only permissions, and the pull_request_target workflow has no untrusted checkout or script-injection sink. All six action references are unpinned, creating a reproducibility and supply-chain hygiene gap.