captcha-eu/typo3

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. The missing scanning coverage is a modest supply-chain hygiene gap.

Security policycaution

The repository has no published security policy. This is a transparency and reporting gap, though it is not evidence that the package is unsafe by itself.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, and it has no top-level write permissions. However, all 6 action references are unpinned, leaving build inputs less reproducible and increasing workflow maintenance risk.