trsteel/ckeditor-bundle

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release and matching repository push partly compensate, but the current development lull lowers confidence in ongoing maintenance.

Repo toolingcaution

The project uses Composer, but no security scanning tools were detected. This is a maintenance and vulnerability-response gap, though it is not evidence of a security defect by itself.

Security policycaution

The repository has no security policy, so users are not given a documented vulnerability-reporting path. The package's release notes and active repository provide some transparency but do not replace that guidance.

Workflow auditcaution

Both workflows were analyzed successfully and contain no untrusted checkouts or script-injection findings, but all 7 action references are unpinned. The absence of a top-level permissions block is acceptable on its own, while unpinned actions remain a supply-chain hygiene weakness.