cors/web-care

Dangerous workflowscaution

Two of four workflows use pull_request_target, which can carry elevated trust requirements when processing pull requests. No untrusted checkout or script-injection patterns were detected, partially compensating for the workflow concern.

Repo bus factorcaution

All 4 recent commits came from one contributor, giving the project a concentrated short-term contributor base. Organizational ownership provides some handoff capacity, but it does not remove the continuity concern.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tools were detected. The build setup is present; the missing automated security coverage is a modest transparency gap.

Security policycaution

No repository security policy was found. This does not show abandonment, but it leaves vulnerability reporting and response expectations undocumented.

Token permissionscaution

Three workflows use read-only permissions, while one workflow declares top-level write permissions. The limited write use is a manageable workflow-governance concern rather than a severe risk.