swag/swag-extension-store

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating a genuine concern that the package-to-repository relationship is not clearly demonstrated despite the organization ownership.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest security-process transparency gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Token permissionscaution

All four workflows omit top-level token permissions declarations. No workflow requests top-level write access, but explicit least-privilege declarations would provide stronger CI security hygiene.