horde/lock

Repo bus factorcaution

One contributor made all recent commits, creating a concentrated maintenance dependency. Organization ownership offers some continuity, but no second recently active contributor is shown.

Repo commit activitycaution

Only three commits were made in the last three months by one active maintainer. This shows recent maintenance but indicates limited current capacity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are reported. That weakens transparency around automated security checks without indicating abandonment by itself.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, not evidence that the release is unsafe.

Workflow auditcaution

The workflows have no dangerous triggers or audit findings, and one scopes permissions at job level. However, six of seven action references are unpinned, reducing build reproducibility and supply-chain control.