eddmann/terrarium

Project backingcaution

The registry namespace and repository are owned by the same individual, so the package has clear ownership but no organizational backing to provide maintenance redundancy.

Repo bus factorcaution

All 31 commits in the last three months came from one contributor, so maintenance depends heavily on a single individual and could be disrupted if they become unavailable.

Repo toolingcaution

The project uses Make and Composer for builds, but no security-scanning tools were detected. For a package centered on sandboxing untrusted code, that missing automated security coverage is a meaningful transparency gap.

Security policycaution

The repository has no security policy. That leaves vulnerability reporting and the project's security-response process unclear, which matters for a sandboxing-focused package.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow grants write permissions. Although no dangerous workflow patterns were detected, broader write access than necessary increases CI governance risk.