t3g/analytics

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment, given the active repository and tests.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This lowers transparency for an extension that handles API credentials and backend integrations.

Workflow auditcaution

All 8 analyzed action references are unpinned, and the publish workflow has two high-confidence template-injection findings plus top-level write permissions. No untrusted checkout or script-injection trigger was reported, so these are workflow hygiene and release-automation concerns rather than a standalone severe dependency verdict.