bowphp/tintin

Repo bus factorcaution

All 3 recent commits came from one contributor, leaving maintenance dependent on a single active person despite organization ownership.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no published security policy, making vulnerability-reporting expectations less clear for consumers.

Workflow auditcaution

All 7 analyzed action references are unpinned, and one workflow grants top-level write permissions; the pull_request_target trigger has no detected untrusted checkout or script-injection sink, limiting the risk to workflow hygiene.