mwstake/mediawiki-component-datastore

Repo bus factorcaution

All two recent commits came from one contributor, leaving maintenance dependent on a single active person despite organization ownership.

Repo commit activitycaution

The repository recorded two commits in the last three months, showing recent activity but at a modest level.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a transparency and maintenance gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and disclosure expectations less clear.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection trigger, but all seven action references are unpinned. High-confidence template-injection findings are present; without a dangerous trigger they remain workflow hygiene concerns rather than a severe risk.