bluefission/develation

Repo bus factorcaution

One contributor made all 45 commits in the last three months, leaving maintenance highly dependent on a single person; organizational ownership provides some handoff capacity but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected, leaving a meaningful transparency and defensive-process gap.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection path, but its high-confidence finding identifies an unpinned container image; all three action references are also unpinned, weakening build reproducibility.