stellarwp/foundation-wpcli

Dangerous workflowscaution

One workflow uses pull_request_target, which requires careful handling of untrusted pull requests even though no untrusted checkout or script injection was detected.

Repo bus factorcaution

All five recent commits came from one contributor, creating concentration risk; the organization-owned repository provides some ability to transfer maintenance, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a meaningful transparency and vulnerability-monitoring gap.

Security policycaution

The repository has no security policy, so the process for reporting and handling vulnerabilities is not documented.

Token permissionscaution

The only analyzed workflow declares no top-level token permissions. This is less explicit than a read-only default and leaves workflow permissions harder to audit.