diversworld/contao-editorial-workflow

Repo bus factorcaution

One contributor made all 7 commits in the last 3 months, giving the project a bus factor of one. The repository is user-owned rather than organization-owned, so no provided backing signal compensates for that concentration.

Repo commit activitycaution

Seven commits in the last 3 months show ongoing work, but all activity is concentrated in the same contributor identified by the repository signals. This supports current maintenance while leaving limited evidence of durable capacity.

Security policycaution

The repository has no security policy, leaving no documented route for reporting vulnerabilities. This is a transparency gap for a CMS workflow module, though it is not evidence of an active security problem.

Workflow auditcaution

All 6 referenced actions are unpinned, which weakens build reproducibility and exposes CI to upstream action changes. The workflow has no dangerous trigger, injection, or write-permission finding, and the audit completed successfully, so this remains a hygiene caution rather than a severe risk.