middag-io/moodle

Lifecycle scriptscaution

Composer post-install and post-update scripts increase the actions performed during dependency installation and updates. No provided signal shows these scripts are unsafe or unnecessary, so they remain a supply-chain hygiene caveat.

Repo bus factorcaution

One contributor made 97.6% of the 206 recent commits, which is highly concentrated. The second contributor remains active and the repository is organization-owned, providing some handoff capacity but not eliminating the continuity risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. That is a transparency and maintenance gap, though the separate security policy and workflow checks provide partial compensation.

Token permissionscaution

Workflow permissions are explicitly declared, with one workflow using top-level write access and another read-only. The explicit declarations are good hygiene, though write access is broader than strictly read-only automation.