horde/controller

Repo bus factorcaution

All three recent commits came from one contributor, so current maintenance is concentrated. The organization-backed repository partly compensates by providing a broader project context, but individual continuity remains a caution.

Repo toolingcaution

The project uses Composer for builds but reports no security-scanning tools. The missing scanning is a modest transparency gap, while the build tooling itself is appropriate.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, though it is not evidence that the package is unsafe or abandoned.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous sinks or audit findings, and one scopes permissions at job level. However, six of seven action references are unpinned, leaving avoidable build-reproducibility risk.