simonschaufi/typo3-phone

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration has no observed organizational handoff shown by this signal.

Repo bus factorcaution

All 8 commits in the last 3 months came from one contributor, giving the project a single-person bus factor. That concentration increases abandonment and handover risk despite recent activity.

Security policycaution

The repository has no SECURITY.md or other declared security policy. For a package that processes phone-number data, this is a real transparency and response-process gap.

Workflow auditcaution

Both workflows were analyzed, but all 12 action references are unpinned; one workflow has top-level write permissions and a high-confidence bot-conditions finding. The pull_request_target workflow has no untrusted checkout or script-injection sink, so this is a workflow-hygiene caution rather than a severe standalone risk.