darkwood/flow

Repo bus factorcaution

All 11 commits in the last 3 months came from one contributor, giving the project a concentrated maintenance base. Organization backing provides some handoff capacity, but no second recently active contributor is shown.

Repo toolingcaution

The project uses Make and Composer, but no security scanning tools were detected. That is a modest transparency and maintenance-hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. For a maintained library this leaves vulnerability-reporting expectations unclear, creating a small transparency gap.

Workflow auditcaution

Both workflows were analyzed successfully and no audit findings or untrusted checkout/script-injection sinks were reported; the pull_request_target trigger is therefore not concerning on its own. However, all four action references are unpinned, which weakens build reproducibility and workflow supply-chain hygiene.