digitoimistodude/dude-coding-standards

Package scaffoldingcaution

The package includes a substantial README, tests, a changelog, and release notes for version 1.0.11. The README also transparently describes the standard as a work in progress and primarily used by the owning organization, which limits confidence for external consumers.

Repo bus factorcaution

All five recent commits came from one contributor, creating a real continuity risk. Organization backing provides some ability to hand off maintenance, but no second active contributor is shown.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. This is a transparency and assurance gap, though it is not by itself evidence of an unsafe package.

Security policycaution

The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting and response expectations unclear.

Token permissionscaution

Neither workflow declares top-level token permissions, and only one has job-level permissions. Explicit least-privilege permissions would provide stronger protection for the release automation.