horde/timezone

Repo bus factorcaution

One contributor made all commits in the last 3 months. The organization-owned repository partly reduces handoff risk, but the recent contribution base remains concentrated.

Repo commit activitycaution

The repository received 1 commit in the last 3 months, so it is not inactive, but the observed maintenance pace is modest. Recent release activity provides some compensation for the limited commit count.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported. The missing scanner is a maintenance and transparency gap, not evidence of a defect by itself.

Security policycaution

The repository has no security policy. This weakens the documented process for reporting and handling vulnerabilities, although it does not show that the package is unsafe.

Workflow auditcaution

All 3 workflows were analyzed successfully, with no untrusted checkouts, script injection, or audit findings, and no workflow has top-level write permissions. However, 7 of 9 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.