fusio/sdk

Repo bus factorcaution

All five recent commits came from one contributor, so maintenance depends entirely on a single active developer despite organization ownership.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less explicit.

Workflow auditcaution

Both workflows grant top-level write permissions and all three action references are unpinned. The audit found no untrusted checkouts, script injection, or other high-confidence findings, so this is a hygiene caution rather than a severe risk.