egroupware/tracker

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tools were detected. The missing scanner is a modest supply-chain transparency gap, not proof of unsafe code.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although active commits and organization ownership provide some compensating maintenance capacity.

Workflow auditcaution

The single workflow was fully analyzed, has read-only permissions, and produced no audit findings. However, its one action reference is unpinned, leaving a modest reproducibility and action-integrity gap.