atk14/pupiq-client

Repo bus factorcaution

All 11 recent commits came from one contributor, leaving maintenance dependent on a single active person. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo popularitycaution

The repository has only 2 stars and 2 forks, showing limited public adoption; this is supporting caution but is outweighed by the package's activity and maturity.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools are reported; the missing scanning is a modest hygiene gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, leaving a supply-chain hygiene gap.