fgtclb/academic-projects

Repo bus factorcaution

All 58 recent commits came from one contributor, leaving maintenance dependent on a single active individual. Organization ownership provides some handoff capacity but does not remove the present concentration.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected, leaving a modest repository-hygiene gap.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script-injection findings, but all 4 action references are unpinned and the audit found two high-confidence template-injection findings in the publish workflow. Template injection alone is a hygiene concern here, while unpinned actions lower build reproducibility and supply-chain resilience.