restruct/silverstripe-waf

Repo bus factorcaution

All 33 recent commits came from one contributor, concentrating maintenance knowledge and creating a continuity risk. Organization backing provides some ability to hand off work, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For a security-focused package, that is a meaningful transparency and maintenance gap.

Security policycaution

The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting and response expectations undocumented for a security-focused package.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 4 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.