dcardenasl/ci4-api-scaffolding

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single-contributor maintenance concentration is not visibly offset by organizational backing.

Repo bus factorcaution

All 15 recent commits came from one contributor, leaving maintenance dependent on a single person and increasing continuity risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving automated dependency or code scanning coverage unclear.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less transparent.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous audit findings or untrusted checkout sinks, but all 11 action references are unpinned and one workflow grants top-level write access, creating build-integrity and permission-hygiene concerns.