silverstripe/mfa

Repo bus factorcaution

One contributor made all commits in the last 3 months, giving the recent repository activity a single-contributor concentration. Organizational ownership provides some handoff capacity, but no second recent contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, indicating narrow recent development activity even though the package continues to release.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected; this is a transparency and maintenance gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and handling expectations undocumented.

Workflow auditcaution

All 8 workflows were analyzed without audit findings or untrusted checkouts, and six use read-only permissions. However, all 7 analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.