wpmetabox/mb-custom-post-type

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations. These are not inherently unsafe, but they increase installation behavior that developers should understand.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. That is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. This leaves vulnerability reporting and response expectations unclear, though active commits and organization backing partly compensate.

Workflow auditcaution

All three workflows use unpinned actions, which weakens build reproducibility and action supply-chain control. The audit found no dangerous triggers, untrusted checkouts, script injections, high-severity findings, or incomplete files.