evoweb/sf-register

Lifecycle scriptscaution

Three Composer install and update lifecycle scripts run during package operations, increasing execution complexity and supply-chain exposure even though such scripts can be legitimate for PHP packages.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the highly concentrated recent commit activity provides limited evidence of maintenance handoff capacity.

Repo bus factorcaution

One contributor made 66 of 68 recent commits, so maintenance is highly concentrated despite two additional active contributors; this raises continuity risk.

Repo toolingcaution

Composer and make provide build tooling, but no security-scanning tool was detected in the repository, leaving a modest transparency and hygiene gap.

Workflow auditcaution

Both workflows were analyzed without failed files or audit findings, and no untrusted checkout or script-injection risks were found. However, 3 of 6 action references are unpinned and one workflow grants top-level write permissions, creating moderate workflow hygiene risk.