flowpack/content-security-policy

Repo bus factorcaution

One contributor made all recent commits, leaving maintenance capacity concentrated in a single person; organization backing provides some ability to hand work off.

Repo commit activitycaution

There was one commit in the last 3 months, so recent development is present but sparse.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest verification gap.

Security policycaution

The repository has no published security policy, making vulnerability reporting and response expectations less transparent.

Workflow auditcaution

The single workflow was fully audited with no dangerous triggers or audit findings, but all 6 action references are unpinned, reducing build reproducibility and supply-chain protection.