gally/gally-standard

Dependency profilecaution

The package has 20 runtime dependencies, reflecting a broad application-oriented integration surface. This adds maintenance complexity but is consistent with the substantial functionality shown by the repository.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a modest transparency gap, not evidence of unsafe code by itself.

Workflow auditcaution

Both workflows were fully analyzed with no audit findings, no untrusted checkouts, and no script injection. However, all 7 action references are unpinned, leaving a supply-chain hygiene gap; the pull_request_target triggers do not have a dangerous sink in the observed workflows.