simplecms/framework

Dependency profilecaution

Nine runtime dependencies create a relatively broad maintenance surface for a framework package, including media, messaging, and Excel integrations. The signal does not show that any dependency is abandoned or unsafe, so this is a moderate concern rather than a severe risk.

Repo bus factorcaution

All five recent commits came from one contributor, leaving no demonstrated backup maintainer in the recent activity window. The single-person ownership increases continuity risk.

Security policycaution

The repository has no security policy. For a framework handling authentication, permissions, and application infrastructure, this weakens vulnerability-reporting transparency.

Workflow auditcaution

The only workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, and it avoids broad top-level write permissions. One of two action references is unpinned, which leaves a modest reproducibility and supply-chain hygiene gap.