horde/icalendar

Repo bus factorcaution

All recent commits come from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only 3 commits were made in the last 3 months by one active maintainer, indicating modest recent activity rather than a broad maintenance stream.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest verification gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers, injection sinks, or audit findings, and one scopes permissions at job level. However, 6 of 7 action references are unpinned, weakening build reproducibility and supply-chain control.