drieam/eduframe-php-client

Repo bus factorcaution

All two recent commits came from one contributor. Organization ownership provides some handoff capacity, but the observed recent activity remains concentrated.

Repo commit activitycaution

The repository had two commits in the last 3 months, so it is active, but the pace is light for a client library that may need API maintenance.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All four analyzed action references are unpinned, one workflow grants top-level write permissions, and a high-confidence finding reports a GitHub App token inheriting blanket installation permissions. The audit was complete and found no untrusted checkout or script-injection path, but the workflow setup still warrants caution.