thelia/seone-module

Licensecaution

The manifest declares GPL-3.0-or-later, while the artifact license file is detected as MIT; although both the artifact and repository contain license files, this unresolved mismatch creates legal uncertainty.

Repo package mentioncaution

The linked repository name does not match the package name and its README does not mention the package, so ownership of the published package is not clearly established.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected; the missing scanner is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented and reducing maintenance transparency.

Workflow auditcaution

The sole workflow was fully analyzed with no reported audit findings or untrusted-code sinks. Its one action reference is unpinned, which is a minor reproducibility and supply-chain hygiene concern.