webfactory/piwik-bundle

Repo bus factorcaution

One contributor made all commits in the last three months. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing limited recent development activity. The recent release history partly offsets this, but maintenance momentum is not strong.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency and maintenance-process gap rather than evidence of an unsafe release.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. The package's tests and established release history provide some compensating maturity evidence.

Workflow auditcaution

All 8 analyzed GitHub Actions references are unpinned, which weakens build reproducibility and action supply-chain control. The audit found no untrusted checkouts, script injection, write-wide permissions, or other reported findings.