phpbb/autogroups

Repo bus factorcaution

All three recent commits came from one contributor, concentrating current activity in a single person. Organizational backing partly reduces handoff risk, but the recent contributor base remains narrow.

Repo toolingcaution

Composer and Phing build tooling are present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting expectations unspecified. This is a minor transparency gap for a maintained extension.

Workflow auditcaution

Both workflows were analyzed cleanly with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned and one workflow grants top-level write access, creating a moderate workflow-hygiene concern.