adereksisusanto/dapodik-api-php

Dangerous workflowscaution

One of four workflows uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script-injection patterns were detected, so this is a workflow-review caution rather than a severe health issue.

Maintainerscaution

Only one account has registry publish access. This is a meaningful resilience concern for a user-owned project because publication continuity depends on a single maintainer.

Project backingcaution

The repository is owned by a User account rather than an organization, so the single-maintainer publishing model has no visible organizational backing to compensate for its limited bus factor.

Release historycaution

The package is 756 days old with eight releases, but only one release occurred in the last 12 months; this indicates slower release activity and warrants maintenance caution, although the package is not abandoned based on the other evidence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although two pull requests were merged recently, the collapsed recent commit activity raises abandonment and maintenance-continuity concerns.