cognesy/instructor-templates

Repo bus factorcaution

One contributor made all 13 commits in the last 3 months, creating a genuine continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer is used as the build tool, but no repository security scanning tools were detected. The missing scanning is a maintenance and transparency gap, though not severe on its own.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented. This is a real transparency gap but does not by itself make the release unfit.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings, no untrusted checkout or script-injection sink, and no top-level write permissions. Its one action is unpinned, which is a supply-chain hygiene weakness; the pull_request_target trigger is ordinary without a dangerous sink.