astroway/sdk

Repo bus factorcaution

One contributor made all 10 commits in the last three months, creating a meaningful continuity risk, although organization ownership provides some handoff capacity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a repository hygiene gap.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency even though this is not evidence of a vulnerability.

Workflow auditcaution

Both workflows were analyzed cleanly with no dangerous triggers, untrusted checkouts, or audit findings. However, all four action references are unpinned and one release workflow grants top-level write permissions, creating workflow hygiene and token-scope concerns.