winter/wn-user-plugin

Repo toolingcaution

The project uses Composer build tooling but reports no security scanning tools, leaving a modest transparency and preventive-review gap.

Workflow auditcaution

Both workflows were analyzed successfully and have no untrusted checkout or script-injection trigger, but all four action references are unpinned and the audit found a high-confidence template-injection issue. The template finding is not paired with a dangerous trigger, so this is a hygiene concern rather than a severe release risk.