hershel-theodore-layton/sgml-stream-interfaces

Project backingcaution

The package is maintained under a personal repository rather than an organization, so the single recent contributor represents a genuine bus-factor concern.

Repo bus factorcaution

All five recent commits came from one contributor, leaving maintenance dependent on a single person despite the recent activity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; this is a modest project-hygiene gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities are reported and handled.

Workflow auditcaution

The only workflow was fully analyzed with no untrusted checkout or script-injection findings, but both action references were unpinned and the low-confidence unpinned-image findings weaken build reproducibility.