silverstripe/session-manager

Repo bus factorcaution

All recent commits came from one contributor, creating a narrow recent activity base. Organization backing partly compensates, but no second active contributor is shown for this period.

Repo commit activitycaution

Only one commit was recorded in the last three months, so direct repository activity is currently light even though the package release history remains active.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, making vulnerability-reporting expectations less explicit for users and maintainers.

Workflow auditcaution

All eight workflows were analyzed successfully with no detected audit findings, no untrusted checkout or script-injection paths, and read-only permissions in six workflows. However, all seven action references are unpinned, which weakens build reproducibility and supply-chain hygiene.