horde/rdo

Repo bus factorcaution

All 3 recent commits came from one contributor, giving the project a concentrated maintenance base. Organization backing partly offsets individual-contributor risk, but succession capacity is not demonstrated here.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. For a database-facing ORM library, this reduces the transparency of vulnerability reporting and response expectations.

Workflow auditcaution

Both workflows were analyzed successfully and have no reported audit findings; one scopes permissions at job level and neither uses dangerous untrusted triggers. However, 6 of 7 action references are unpinned, leaving avoidable build-integrity exposure.