horde/core

Dependency profilecaution

The framework declares 52 runtime dependencies, which increases dependency surface and upgrade burden, although the broad set is consistent with a framework foundation package.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, so there is no documented route for reporting vulnerabilities or describing security handling.

Workflow auditcaution

All three workflows were analyzed without trigger or injection findings, and one scopes permissions at job level. However, 7 of 9 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.