silverstripe/tagfield

Repo bus factorcaution

All recent commit activity came from one contributor, giving the repository a concentrated short-term maintenance base; organizational backing provides some handoff capacity but does not remove the concentration.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating limited recent development activity despite the recent release and merged pull requests.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no published security policy, so users have no documented security-reporting process to follow.

Workflow auditcaution

All 7 workflow action references are unpinned, which weakens build reproducibility. Six workflows use read-only permissions, there are no untrusted checkouts or script injections, and the pull_request_target trigger has no reported sink.