fleetbase/core-api

Dependency profilecaution

The package declares 44 runtime dependencies, including several framework, storage, messaging, and integration packages. This broad dependency surface increases upgrade and transitive-maintenance exposure, but is consistent with a core API framework.

Repo bus factorcaution

Three contributors were active in the last three months, but one contributor made about 94% of commits. Organization backing provides some handoff capacity, yet the observed activity remains highly concentrated.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected. This is a modest transparency and assurance gap, not evidence of abandonment.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although the strong release and commit activity partly compensates for the gap.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts or script injection, and two workflows use read-only permissions. However, all 8 action references are unpinned and two high-confidence medium findings pass inherited secrets to reusable workflows, creating avoidable workflow supply-chain exposure.