magendoo/module-faq

Repo bus factorcaution

All 17 recent commits came from one contributor, creating a meaningful continuity risk. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected. That leaves a transparency and maintenance gap for a package with substantial application code.

Workflow auditcaution

Both workflows were analyzed without untrusted checkouts or script injection, but all six action references are unpinned and the release workflow has top-level write permissions. The reported cache-poisoning issue has low confidence, so it is treated as hygiene rather than a severe risk.