wp-pay-extensions/gravityforms

Repo bus factorcaution

Recent work is concentrated entirely in one contributor, creating a real continuity risk. The organization-owned repository provides some ability to hand maintenance to another contributor, which keeps this from being a severe concern.

Repo commit activitycaution

Five commits were made in the last three months, showing recent activity, but all recent activity came from one active maintainer.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected. This is a transparency and process gap, though it is not by itself evidence that the release is unsafe.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear for a payment-related integration.

Token permissionscaution

The only workflow lacks a top-level permissions declaration, so its token permissions are less explicit than preferred. No top-level write permissions were detected.