capell-app/demo-kit

Workflow auditdanger

The only workflow combines a pull_request_target trigger and an untrusted checkout with top-level write permissions; all two action references are also unpinned. This gives untrusted code a broader token than necessary and increases workflow supply-chain exposure.

Repo bus factorcaution

All 16 recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less clear.

Version stabilitycaution

This is a prerelease, and every recent release is also a prerelease, so API and behavior stability remain uncertain despite the active cadence.