biigle/kpis

Repo bus factorcaution

All 7 recent commits came from one contributor, leaving the project dependent on a single active maintainer. Organization ownership provides some handoff capacity but does not remove this concentration risk.

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tools were detected, leaving an avoidable gap in automated supply-chain hygiene.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, though it is not by itself evidence of abandonment.

Workflow auditcaution

Both analyzed workflows completed without dangerous triggers, untrusted checkouts, script injection, or audit findings, and neither grants top-level write permissions. However, both of the two action references are unpinned, which weakens build reproducibility.