silverstripe/spamprotection

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but the observed recent activity is still concentrated.

Repo commit activitycaution

There was one commit in the past three months from one active maintainer, showing recent activity but a thin current maintenance record.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tool was detected. This is a modest transparency and assurance gap, not evidence of unsafe code.

Security policycaution

The repository has no documented security policy, leaving vulnerability reporting and response expectations unspecified.

Workflow auditcaution

All six workflows were analyzed with no audit findings, and five use read-only permissions; however, all six action references are unpinned, reducing build reproducibility. The pull_request_target trigger has no untrusted checkout or script-injection sink.