typo3/coding-standards

Repo bus factorcaution

All 8 recent commits came from one contributor, creating concentration risk. Organization ownership provides some handoff capacity, so this is a caution rather than a severe abandonment signal.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For a coding-standards package this is a modest transparency gap, not evidence of unsafe behavior.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a maintenance and transparency gap, but the organization-backed repository partly reduces the concern.

Version stabilitycaution

Version 0.9.0 is not a stable major release, which signals some API maturity uncertainty, but it is not marked as a prerelease and has no recent prerelease pattern.

Workflow auditcaution

Both workflows were analyzed cleanly and no audit findings or untrusted checkout sinks were reported. However, all 18 action references are unpinned, weakening build reproducibility and update safety.