drupflare/rom

Repo bus factorcaution

All 92 recent commits came from one contributor, so maintenance depends heavily on a single person; organization backing provides some handoff capacity but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and response.

Version stabilitycaution

The release is not marked prerelease, but version 0.3.0 indicates an early-stage API that may still change materially.

Workflow auditcaution

All five workflows use job-level permissions and have no untrusted checkout or script-injection findings, but all 21 analyzed action references are unpinned, weakening build reproducibility.