adamjenkins/moodle-local_oerexchange

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration is not offset by visible organizational handoff capacity.

Repo bus factorcaution

All 147 recent commits came from one contributor, making maintenance continuity dependent on a single person.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and detection gap.

Security policycaution

The repository has no security policy, so there is no documented channel or process for reporting vulnerabilities.

Workflow auditcaution

All six analyzed action references are unpinned, and the release workflow has high-confidence template-injection findings; no untrusted checkout or script-injection trigger was reported, so this is a meaningful hygiene concern rather than a severe workflow risk.