thunder/thunder-distribution

Dependency profilecaution

This is a Drupal distribution with 61 runtime dependencies, a broad integration surface that increases upgrade and maintenance complexity but is consistent with its stated distribution role.

Repo toolingcaution

Composer is used as the build tool, providing standard build structure, although no security scanning tools were detected.

Security policycaution

The repository has no published security policy, which leaves vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All 31 analyzed action references are unpinned, and three high-confidence findings identify container images using the floating latest tag in tests.yml. The low-confidence cache-poisoning finding is hygiene only; there are no untrusted checkouts or script-injection findings.