hershel-theodore-layton/portable-hack-ast

Repo bus factorcaution

All 27 recent commits came from one contributor, giving the project a single-person maintenance dependency. The active commit volume helps, but does not remove succession and continuity risk.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tool was detected. This is a modest transparency and preventive-maintenance gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. For a source-processing library this reduces clarity about vulnerability reporting and response expectations.

Workflow auditcaution

The workflow audit completed fully and found read-only permissions with no untrusted checkout or script-injection paths. It did identify two low-confidence high-severity unpinned-image findings; these are workflow hygiene concerns, not a standalone severe risk.