weglot/craft-translate

Repo bus factorcaution

One contributor made 90% of the 20 recent commits, creating concentration risk, though a second contributor remains active and the repository is organization-owned.

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package, so package-to-repository identity is less explicit; the shared organization provides some context but does not fully remove the gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear despite its security scanning tools.

Workflow auditcaution

Both workflows were analyzed successfully with no audit findings or untrusted checkout and script-injection patterns. All four action references are unpinned, which is a workflow hygiene weakness.