geekcodev/max-php-client

Project backingcaution

The registry namespace and repository owner match, but the owner is an individual user rather than an organization; this supports package identity while offering limited evidence of institutional maintenance capacity.

Repo bus factorcaution

All 16 commits in the last three months came from one contributor, leaving a meaningful continuity risk if that person becomes unavailable. The repository is user-owned rather than organization-owned, so there is no shown organizational handoff benefit.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a transparency gap, though the clean workflow findings and active repository partly compensate for it.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented for a security-sensitive API client.

Token permissionscaution

The CI workflow does not declare top-level token permissions. No write permissions were detected, but explicitly restricting permissions would provide stronger workflow transparency.