flowpack/media-ui

Repo bus factorcaution

One contributor made about 90% of the recent commits. The other two active contributors and organization ownership provide some continuity, but concentration remains a maintenance caution.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, reducing clarity about how vulnerabilities should be reported and handled.

Workflow auditcaution

Both workflows were analyzed without failures, but all 17 action references are unpinned and the audit reported high-confidence template-injection patterns in create-tag.yml. No untrusted checkout or script-injection sink was found, so this is a hygiene concern rather than a severe dependency verdict.