calien/secure-filemount

Project backingcaution

The repository is owned by a personal account rather than an organization, so the single-contributor concentration is not visibly offset by organizational backing.

Repo bus factorcaution

One contributor made 100% of the 8 recent commits, leaving maintenance highly concentrated and increasing continuity risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving security checks less transparent.

Security policycaution

The repository has no security policy, so vulnerability reporting and maintainer response expectations are not documented.

Workflow auditcaution

All 8 analyzed action references are unpinned, and the audit reports two high-confidence template-injection findings in the publish workflow; with no untrusted checkout or script-injection trigger, these are workflow hygiene concerns rather than a standalone severe risk.