nswdpc/silverstripe-elemental-banner

Repo bus factorcaution

All five recent commits came from one contributor, giving the project a concentrated maintenance base. Organization ownership partly offsets handoff risk, but does not eliminate dependence on that contributor.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanner is a modest transparency and maintenance gap, not evidence of an unsafe release.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a maintenance and transparency gap for dependents.

Workflow auditcaution

The single workflow has no untrusted checkout or injection findings and no top-level write permissions, but both action references are unpinned. That is a supply-chain hygiene weakness without a demonstrated dangerous workflow.