siratik/baseline

Release historycaution

This is the first release, published 0 days ago, so there is no demonstrated release track record yet. That is an early maturity concern rather than evidence of abandonment.

Repo bus factorcaution

All 8 recent commits came from one contributor, giving the project a high concentration of maintenance responsibility. Organizational ownership partly offsets handoff risk, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is used, but no security scanning tool was detected. This is a modest transparency and assurance gap for a security-focused WordPress package.

Version stabilitycaution

The release is v0.1.0 and the README identifies the public surface as pre-1.0 and subject to breaking changes without deprecation cycles. Consumers should expect API instability.

Workflow auditcaution

All three workflows use unpinned actions, and each has a high-confidence medium-severity secrets-inherit finding. There are no untrusted checkouts or script injections, and one workflow scopes permissions at job level, which limits but does not remove the workflow hygiene concern.