answear/gls-bundle

Repo bus factorcaution

All recent commits came from one contributor, creating concentration risk. Organization ownership provides some handoff capacity, but no second recently active contributor is shown.

Repo commit activitycaution

Only one commit from one maintainer was recorded in the last three months. Recent release activity partly offsets the thin short-term activity, but the narrow maintenance base remains a caution.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a minor transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no published security policy. For a package making external API requests, this weakens vulnerability-reporting transparency.

Workflow auditcaution

Both workflows were analyzed completely with no injection findings, unsafe triggers, or broad top-level write permissions. However, all six action references are unpinned, leaving avoidable build-reproducibility risk.