b13/headertypes

Repo bus factorcaution

All nine recent commits came from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown, leaving maintenance continuity concentrated.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no security policy. This is a transparency gap, although the package's small backend-only scope limits its practical impact.

Workflow auditcaution

Both workflows were analyzed without failures and have no untrusted checkouts or script-injection findings, but all four action references are unpinned and the publish workflow has a high-confidence template-injection finding. The lack of a top-level permissions block is acceptable on its own.