imi/magento2-friendly-captcha

Repo bus factorcaution

All recent commits came from one contributor, which creates concentration risk. The organization-owned repository provides some handoff capacity, so this is a caution rather than a severe dependency risk.

Repo commit activitycaution

Only one commit from one active maintainer was observed in the last three months. Although the recent release indicates the project is not abandoned, the low short-term activity is a maintenance concern.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tool was detected. The standard build tooling is appropriate, while the missing security automation leaves a modest transparency gap.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although it does not by itself indicate abandonment or make the release unfit to use.

Token permissionscaution

Seven workflows omit top-level token permissions and one release workflow grants top-level write access. This is weaker CI permission hygiene and increases operational risk, though the separate workflow analysis found no dangerous workflow patterns.