drupal/drupal-extension

Repo bus factorcaution

All 15 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited redundancy.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; the missing scanning is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented for consumers.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings or untrusted checkouts, but 6 of 8 action references are unpinned and one workflow grants top-level write access, creating moderate workflow hygiene concerns.