clancats/container

Lifecycle scriptscaution

A post-autoload-dump Composer script runs during installation or autoload generation. This adds execution-time supply-chain exposure, although the signal does not show suspicious behavior.

Repo bus factorcaution

One contributor made about 83% of recent commits, creating concentration risk. The second active contributor and organization ownership provide partial compensation.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanning layer is a moderate transparency and hygiene gap.

Security policycaution

The repository has no security policy. For a dependency-injection library, this leaves vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed successfully with no reported audit findings or untrusted checkouts, but all 8 action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene weaknesses rather than severe risks on their own.