dbp/relay-verity-connector-clamav-bundle

Repo bus factorcaution

One contributor made all 17 commits in the last three months, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is evidenced.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a transparency and maintenance gap, though it is not severe given the otherwise active repository.

Security policycaution

The repository has no security policy. That weakens disclosure guidance for a package handling remote antivirus-service integration, but it does not by itself indicate abandonment.

Token permissionscaution

The only workflow lacks top-level token permissions. No write permissions were declared, but the absence of an explicit restrictive policy is a modest workflow-hardening gap.