horde/elasticsearch

Repo bus factorcaution

All two recent commits came from one contributor, creating a meaningful concentration risk even though the repository is owned by an organization.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected, leaving repository-level security hygiene less visible.

Security policycaution

The repository has no security policy, which weakens guidance and transparency for vulnerability reporting.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings and no broad top-level write permission, but two of its three action references are unpinned, leaving avoidable build-integrity risk.