solidbunch/starter-kit-foundation

Dependency profilecaution

The release declares 12 runtime dependencies spanning WordPress, monitoring, plugins, and installation tooling. That is a substantial dependency surface for a starter kit, increasing transitive maintenance exposure without indicating a problem by itself.

Lifecycle scriptscaution

Composer install and update lifecycle scripts run automatically, increasing the impact of compromised dependencies or unexpected package behavior. This is a supply-chain exposure, though lifecycle scripts are plausible for an infrastructure starter kit.

Release historycaution

The package has 15 releases, but none in the last 12 months; the latest registry release was over a year ago. Recent repository activity partly compensates for the stale publication cadence, so this is a maintenance concern rather than abandonment evidence.

Repo bus factorcaution

One contributor made 100% of the 167 commits in the last three months. Organization ownership provides some handoff capacity, but no second active contributor is shown, so the package remains dependent on one person in practice.

Security policycaution

The repository has no security policy. For a package that provisions Docker, WordPress, credentials, and deployment infrastructure, this is a meaningful transparency and incident-reporting gap.