terminal42/contao-geoip2-country

Repo bus factorcaution

All two recent commits came from one contributor, leaving maintenance dependent on a single active individual. Organization backing provides some capacity for handoff but does not remove the concentration concern.

Repo toolingcaution

The project uses Composer build tooling, but no security-scanning tool was detected. This is a modest transparency gap rather than evidence of unsafe behavior.

Security policycaution

The repository has no security policy, reducing guidance for reporting and handling vulnerabilities in a package that processes visitor IP data.

Workflow auditcaution

The single workflow was fully analyzed and uses read-only permissions with no detected injection or secret findings. Its one action reference is unpinned, which is a minor reproducibility and supply-chain hygiene gap.