digital-marketing-framework/typo3-distributor-salesforce

Lifecycle scriptscaution

The package defines a post-autoload-dump lifecycle script. This is common Composer integration behavior, but it adds install-time execution that consumers should understand.

Repo bus factorcaution

One contributor made all two commits in the last 3 months, giving that contributor a 100% share. Organization ownership provides some handoff capacity, but no second recently active contributor is shown.

Repo commit activitycaution

The repository recorded two commits in the last 3 months, with one active maintainer. Activity is present but relatively light, so maintenance capacity is somewhat limited.

Security policycaution

No repository security policy was found. This reduces transparency for reporting and handling vulnerabilities, although Semgrep and Dependabot provide some compensating security coverage.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and pins all four actions. However, it has one high-confidence unpinned container image, leaving the CI build exposed to mutable image changes.