andrewgjohnson/imagettftextgradient

Project backingcaution

The package and repository are owned by the same individual account, so the single-maintainer and concentrated-activity concerns are not offset by organization-level handoff capacity.

Repo bus factorcaution

All recent repository commits came from one contributor, leaving maintenance dependent on a single person despite the project's recent releases.

Repo commit activitycaution

There was one commit in the last 3 months from one active maintainer, so activity is present but limited in volume.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; the existing security policy partly compensates for this hygiene gap.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. Both action references are unpinned, which is a modest reproducibility and supply-chain hygiene concern.