nswdpc/silverstripe-chimple

Repo bus factorcaution

One contributor made all 11 commits in the last 3 months, giving the repository a 100% top-contributor share. Organization backing provides some handoff capacity, but no second recent contributor is evidenced, so maintenance continuity remains a concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a moderate transparency and maintenance gap, not evidence of a dangerous package.

Security policycaution

The repository has no security policy. For a package handling Mailchimp integration and subscriber data, this weakens the project's vulnerability-reporting transparency.

Version stabilitycaution

The assessed release is marked as a stable major and is not a prerelease, but the registry reports v1.3.0 as the latest version despite this assessment being for v2.0.0. That inconsistency modestly reduces confidence in the version metadata.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or high-severity issues. Both action references are unpinned, however, and the workflow lacks a top-level permissions block, leaving build reproducibility and token scoping weaker than ideal.