coldtrick/opensearch

Repo bus factorcaution

All four recent commits came from one contributor, concentrating current maintenance responsibility and creating a real continuity risk.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. This is a modest transparency and maintenance concern, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance undocumented.

Workflow auditcaution

All three workflows were analyzed without dangerous triggers or audit findings, but all four analyzed action references are unpinned. The absence of top-level permissions is acceptable on its own, while unpinned actions create a limited supply-chain hygiene concern.