wdb/be-theme-legacy

Repo bus factorcaution

All three recent commits came from one contributor, so maintenance is concentrated and continuity depends on a single person.

Repo popularitycaution

The repository has only 2 stars and no forks or watchers, indicating limited external adoption; this is supporting evidence rather than a decisive health problem.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; this is a modest transparency and assurance gap for a package with active workflows.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

Both workflows scope permissions at job level, but all 9 action references are unpinned. A high-confidence template-injection finding appears in deploy.yml; the low-confidence cache findings are hygiene concerns only.