bowphp/framework

Dependency profilecaution

The package declares 13 runtime dependencies, including several PHP extensions and framework components; this is a meaningful integration surface but not unusually large for a full web framework.

Repo bus factorcaution

One contributor made all 11 commits in the last 3 months, concentrating current maintenance knowledge and creating a meaningful continuity risk; organization backing partly compensates.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected, leaving automated dependency or code-security coverage unclear.

Security policycaution

The repository has no security policy, so vulnerability reporting and disclosure expectations are less transparent.

Workflow auditcaution

All five workflows were analyzed, but all nine action references are unpinned and two workflows grant top-level write permissions. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are hygiene concerns rather than a severe workflow risk.