flightphp/core

Lifecycle scriptscaution

A post-install Composer script is present. Install-time execution adds some supply-chain and reproducibility exposure, but this signal alone does not show that the script is unsafe.

Repo bus factorcaution

One contributor made about 88% of the 102 recent commits, creating concentration risk. Two additional contributors remain active, and organization backing partly compensates for the low individual distribution.

Repo issue activitycaution

One pull request was merged in the last month, but issue and pull-request totals are unavailable and no new issues were recorded, so this is only limited activity evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and defense-in-depth gap.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings. Both of its two action references are unpinned, which is a workflow hygiene and reproducibility caution.