doppar/bloom

Repo bus factorcaution

One contributor made all commits in the last three months, creating a concentrated maintenance base. Organization ownership provides some ability to hand maintenance off, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, which is thin activity, although the recent release and merged pull requests provide compensating evidence.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected, leaving a modest transparency and maintenance gap.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, but all 8 action references are unpinned and two workflows grant top-level write permissions. These are CI supply-chain and least-privilege hygiene concerns, not standalone severe risks.