softspring/cms-blog-plugin

Repo bus factorcaution

All one recent commit came from a single contributor, which concentrates practical maintenance knowledge; organization ownership provides some ability to hand maintenance off.

Repo commit activitycaution

Only one commit from one active maintainer was recorded in the last three months, indicating limited recent development activity despite the strong registry release cadence.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, reducing guidance for reporting and handling vulnerabilities.

Workflow auditcaution

The workflow audit is complete, finds no dangerous sinks or audit findings, and reports read-only permissions; however, all 4 action references are unpinned, weakening build reproducibility.