contao-community-alliance/merger2

Repo bus factorcaution

All seven recent commits came from one contributor, giving the project a single-contributor bus factor over the last three months. Organization backing partly offsets this concentration, but it remains a maintenance-continuity concern.

Security policycaution

The repository has no security policy. That is a transparency gap for reporting and handling vulnerabilities, although it does not outweigh the package's active maintenance evidence.

Workflow auditcaution

All five workflow action references are unpinned, which weakens build reproducibility. The audit also found one high-confidence unsound condition, but there are no untrusted checkouts, script injections, or broad top-level write permissions, so this is a hygiene concern rather than a severe dependency risk.