ernestdefoe/fantasy

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no shown organizational handoff capacity. The two active contributors partly offset that limitation.

Release historycaution

This is the package's first release, published today, so there is no registry history to demonstrate sustained maintenance or compatibility over time.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. That is a modest transparency and maintenance gap for a new package.

Security policycaution

The repository has no security policy. This does not make the release unsafe by itself, but it leaves vulnerability reporting and response expectations unclear.

Workflow auditcaution

Both workflows were fully audited with no reported findings, no untrusted checkouts, and no unpinned action references. One workflow grants top-level write permission, a mild hygiene concern, but no untrusted path was found to reach it.