janborg/contao-h4a_gamestats

Project backingcaution

The registry and repository are owned by the same individual account, so the package identity is clear, but there is no organization backing to offset the concentrated contributor activity.

Repo bus factorcaution

Two contributors were active, but the leading contributor made about 83% of recent commits, leaving maintenance meaningfully concentrated.

Security policycaution

The repository has no security policy, which leaves vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed successfully with no reported audit findings or untrusted checkout and script-injection paths. However, all nine action references are unpinned and one workflow grants top-level write permissions, creating workflow hygiene and change-control concerns.