elasticms/submission-bundle

Repo bus factorcaution

One contributor made all recent commits, creating a concentrated bus factor. Organization backing partly offsets individual dependency, but it does not remove the risk of a single active maintainer.

Repo commit activitycaution

Only two commits were recorded in the last three months, with one active maintainer. This is some recent activity, but the low volume indicates limited maintenance capacity.

Repo toolingcaution

Composer is used for builds, but no security-scanning tools were detected. The absence of scanning is a hygiene gap, not evidence that the package is unsafe or abandoned.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although active releases and organization ownership provide some compensating maintenance context.

Workflow auditcaution

The single workflow was fully analyzed with no detected injection or high-severity findings, and it has no top-level write permissions. Its one action is unpinned, which is a supply-chain hygiene weakness; the pull_request_target trigger has no untrusted checkout or script-injection sink.