os2web/os2web_audit

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. The recent push on the latest release partly offsets this, but ongoing maintenance activity is still thin.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a moderate transparency and maintenance gap.

Security policycaution

The repository has no published security policy, making vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All 13 workflow action references are unpinned, and the audit found a high-confidence template-injection pattern. With no untrusted checkout or script-injection trigger, this is workflow hygiene risk rather than a severe supply-chain verdict.