anvildev/craft-booked

Project backingcaution

The repository is owned by a user account rather than an organization, so the highly concentrated contributor activity has no visible organizational backing to compensate for the bus-factor risk.

Repo bus factorcaution

Two contributors are active, but one made 128 of 131 commits, or about 98%, leaving maintenance highly dependent on a single person.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a package handling bookings and payment integrations.

Workflow auditcaution

The sole workflow uses read-only permissions and has no audited injection or secret findings, but all seven action references are unpinned, weakening build reproducibility and action-integrity controls.