horde/cli

Repo bus factorcaution

All three recent commits came from one contributor, giving the project a concentrated short-term maintenance base. Organization backing provides some handoff capacity but does not remove the current concentration.

Repo commit activitycaution

Only 3 commits were made in the last 3 months, with one active maintainer. That is ongoing activity, but the recent maintenance pace is thin.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency and maintenance-hygiene gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed completely with no audit findings, no untrusted checkouts, and no script injection; job-level permissions are used in one workflow. However, 6 of 7 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.