yurizoom/moonshine-media-manager

Project backingcaution

The package and repository are owned by the same individual account, while two contributors have been active recently; this provides some practical continuity but limited formal organizational backing.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest verification gap.

Security policycaution

The repository has no security policy, which reduces guidance for reporting and handling vulnerabilities in a package that manages uploaded media.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. However, all six action references are unpinned, creating a workflow reproducibility and action-integrity gap.