asgrim/example-pie-extension

Repo bus factorcaution

All recent commits came from one contributor, leaving maintenance dependent on a single person. The regular release history provides some evidence of continued attention but does not remove that concentration risk.

Repo commit activitycaution

There was one commit in the last 3 months, so the repository is still active, though the recent activity is sparse.

Repo toolingcaution

The project uses CMake and Composer, but no security-scanning tooling was detected. That is a modest transparency and maintenance weakness for a compiled extension.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

All 17 analyzed action references are unpinned, and the audit found two high-confidence template-injection findings. No pull_request_target or workflow_run trigger and no untrusted checkout or script-injection sink were reported, so this is workflow hygiene risk rather than a severe standalone issue.