restruct/silverstripe-softscheduler

Repo bus factorcaution

One contributor made all 20 commits in the last 3 months, giving the project a single-person operational dependency. Organizational ownership is a partial compensating signal, but no second active contributor is shown.

Repo toolingcaution

Composer is used for builds, but no security scanning tool is detected. This is a transparency and maintenance-hygiene gap rather than evidence of a specific defect.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented for users and maintainers.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or high-severity findings, and neither grants top-level write access. However, all 11 action references are unpinned, so workflow dependencies can change without a reviewed commit.