flickphp/flick

Maintainerscaution

Only one registry account has publish access. That is a publishing concern, though the matching organization-owned repository provides some backing.

Release historycaution

The package is only 45 days old with six releases, including six in the last 12 months, so it shows active early development but has little long-term history.

Repo bus factorcaution

One contributor made all 11 commits in the last 3 months, leaving a high concentration risk. Organization ownership partially offsets handoff risk but does not provide evidence of another active contributor.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest repository hygiene gap.

Workflow auditcaution

All four workflows were analyzed, but all eight action references are unpinned and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow caution rather than a severe standalone risk.