solidbunch/starter-kit-theme

Repo bus factorcaution

One contributor made 25 of 27 recent commits, creating concentration risk; the second contributor remains active and the repository is organization-owned, which partly offsets the handoff risk.

Repo toolingcaution

Composer is used for builds, but no security-scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no SECURITY.md or other detected security policy, making vulnerability reporting less clear for consumers.

Workflow auditcaution

The single workflow was fully analyzed and has no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 8 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.