drupal/core-vendor-hardening

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance path. This is partly compensated by the repository being owned by the Drupal organization, which can provide handoff capacity.

Repo commit activitycaution

Only one commit from one active maintainer was recorded in the last 3 months, which is thin recent activity. The strong release history provides context but does not fully offset the limited commit sample.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. The missing scanning coverage is a modest transparency and maintenance weakness.

Security policycaution

The repository has no security policy. For a plugin that changes vendor-directory contents and web-server exposure, the absence reduces reporting and response transparency.

Version stabilitycaution

This release is a beta version, which adds some adoption risk compared with a stable release. However, only 10% of recent releases are prereleases, so this is a limited caution rather than a broad instability signal.