stellarwp/assets

Licensecaution

The manifest declares GPL-2.0, but the artifact license file is recognized as MIT; although license files exist in both the artifact and repository, the mismatch creates legal ambiguity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing scanning is a transparency and hygiene gap, not evidence of abandonment by itself.

Security policycaution

The repository has no security policy. For a maintained library this weakens vulnerability-reporting transparency, though recent releases and active maintenance partly compensate.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers, untrusted checkouts, or audit findings, but all six action references are unpinned. The lack of top-level permissions is acceptable here, so the remaining issue is workflow reproducibility hygiene.