boccdotdev/polymedia

Repo bus factorcaution

One contributor made about 91% of recent commits, so maintenance is concentrated. The second active contributor and organization-owned repository partly reduce, but do not eliminate, that continuity risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That is a modest transparency and security-hygiene gap, not evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear for a package that handles media integrations and webhooks.

Workflow auditcaution

The single workflow was fully analyzed with no injection or dangerous-trigger findings, but all four action references are unpinned. That weakens build reproducibility and supply-chain protection.