atlasflow/order-bridge

Repo bus factorcaution

All three recent commits came from one contributor, creating a thin practical maintainer base. Organization ownership partly compensates because maintenance can be handed off, but the observed activity remains concentrated.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanning layer is a modest repository hygiene gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance unspecified. This lowers transparency for a package that transports application data.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all three action references are unpinned, which weakens build reproducibility and supply-chain hygiene.