dereuromark/cakephp-setup

Project backingcaution

The package and repository are both owned by the same individual account. This confirms source alignment but provides no organizational handoff capacity to offset the concentrated maintainer base.

Repo bus factorcaution

All 4 recent commits came from one contributor, giving the project a concentrated maintenance base. Because the repository owner is an individual rather than an organization, this remains a meaningful continuity concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The package still has active releases and repository tests, so this is a modest transparency gap rather than a severe risk.

Security policycaution

The repository has no security policy. That does not show a security defect, but it reduces transparency about how dependency and vulnerability reports are handled.

Workflow auditcaution

Both workflows were analyzed without failures, but all 12 action references are unpinned and a high-confidence finding identifies an unpinned container image; one workflow also grants top-level write permissions. These are workflow supply-chain hygiene concerns, not evidence that the package itself is unsafe.