cgoit/contao-leads-optin-bundle

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, which is a maintenance concern. The same-day repository push and current release history partly compensate, but do not remove the recent inactivity signal.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. Dependabot provides some compensating security tooling, but it does not replace a policy.

Workflow auditcaution

The audit analyzed both workflows without failures and found no dangerous triggers or injection sinks, but all 5 action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene risks, not severe evidence on their own.