bullet/doctrine-utils

Repo bus factorcaution

One contributor made all six commits in the last three months, leaving maintenance dependent on a single active person. Organization ownership provides some handoff capacity but no second active contributor is shown.

Repo popularitycaution

The repository has no stars or forks and only two watchers. This is weak supporting evidence, but popularity is not decisive when recent maintenance and project backing are present.

Security policycaution

The repository has no security policy, leaving no documented path for reporting vulnerabilities or explaining security handling.

Workflow auditcaution

All nine action references are unpinned, and three workflows grant top-level write permissions. A high-confidence bot-condition finding affects the Dependabot auto-merge workflow; no untrusted checkout or script-injection sink was found, so this is a workflow hygiene and release-automation concern rather than a standalone severe risk.