allovince/evathumber

Project backingcaution

The repository is owned by a user account rather than an organization, so there is no provided organizational backing to offset the concentrated maintainer base.

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single active person and increasing abandonment risk.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected, leaving automated vulnerability checks uncovered.

Security policycaution

The repository has no security policy, reducing clarity about how users should report and receive fixes for vulnerabilities.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, and jobs scope permissions; however, all eight action references are unpinned, creating avoidable update and tampering risk.