chillerlan/php-qrcode

Repo bus factorcaution

All 5 recent commits came from one contributor, creating a thin recent contributor base. Organization ownership partly reduces handoff risk, but does not eliminate concentration.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency for a library that processes input and includes reader functionality.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but all 15 action references are unpinned. The audit is complete, so this is a reproducibility and supply-chain hygiene concern rather than a severe workflow risk.