astrogoat/customer-experience

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only 1 commit from 1 active maintainer was recorded in the last 3 months, which is thin recent development activity despite the package's regular release history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Workflow auditcaution

All 3 analyzed workflow references are unpinned, and the audit reports a high-confidence unpinned container image plus template-injection findings. There are no untrusted checkouts or dangerous trigger combinations, but one file failed auditing, so the workflow review is incomplete.