syncgw/roundcube-bundle

Licensecaution

The manifest declares LGPL-3.0-or-later, but the artifact license file and README identify GPL-3.0. The release is licensed, but this mismatch creates uncertainty for adopters.

Maintainerscaution

Only one account has registry publish access. The package is tied to a matching source repository, but the narrow publishing base provides limited operational redundancy.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured. That leaves less automated oversight for dependency and build risks.

Security policycaution

The repository has no security policy. For a server-side synchronization bundle, this reduces transparency about vulnerability reporting and handling.