bartlett/box-manifest

Project backingcaution

The repository owner is an individual rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 37 recent commits came from one contributor, leaving maintenance highly concentrated and creating a meaningful continuity risk.

Repo toolingcaution

Composer and Box provide build tooling, but no security-scanning tool was detected, leaving security hygiene less independently checked.

Security policycaution

The repository has no security policy, so there is no documented process for reporting and handling vulnerabilities.

Workflow auditcaution

All 23 analyzed action references are unpinned, and two workflows have top-level write permissions; the high-confidence template-injection findings are not paired with an untrusted checkout or script-injection path, while the cache findings are low confidence.