dmk/t3rest

Workflow auditdanger

Both workflows were analyzed without audit gaps, but all 11 action references are unpinned and the release workflow has a high-confidence template-injection finding that may expand attacker-controlled input into code. No untrusted checkout or script-injection trigger was detected, limiting the severity.

Licensecaution

The manifest declares GPL-2.0-or-later, but the detected artifact license is MIT; although license files are present, this mismatch requires clarification before use.

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. This is a supply-chain-sensitive behavior, but it is a normal Composer lifecycle hook and is not severe on its own.

Repo bus factorcaution

All 4 recent commits came from one contributor, creating a meaningful continuity risk even though the repository owner is an organization.

Repo popularitycaution

The repository has only 1 star and 1 fork, indicating limited adoption evidence. Popularity is supporting evidence rather than a decisive health measure.