dmk/mklog

Repo bus factorcaution

One contributor made all 3 commits in the last 3 months, creating a concentrated maintenance path. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only 3 commits were made in the last 3 months, indicating limited recent activity. The active release history partly compensates, but the repository signal remains a mild maintenance concern.

Repo toolingcaution

The project uses Composer, but no security scanning tool was detected. For a package with release workflows, that is a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy. This makes vulnerability reporting and response expectations less clear for downstream users.

Workflow auditcaution

Both workflows were analyzed, but all 11 action references are unpinned, and a high-confidence template-injection finding appears in the release workflow. No untrusted checkout or dangerous trigger was reported, so this is workflow hygiene risk rather than a severe standalone risk.