roundcube/carddav

Repo bus factorcaution

All recent commits came from one contributor, leaving maintenance dependent on a single active developer; the repository owner is an individual rather than an organization.

Repo commit activitycaution

Only 1 commit was made in the last 3 months, indicating limited recent development activity despite the current release and recent push.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear for a package that integrates with webmail and address books.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 9 action references are unpinned, which weakens reproducibility and update integrity.