honey-odm/core

Project backingcaution

The repository is owned by an individual rather than an organization, so maintenance continuity depends on a small personal project team. The two active contributors partly compensate for that limitation.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than a release-blocking issue.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and handling expectations undocumented.

Version stabilitycaution

The assessed release is a beta and every recent release is a prerelease, so the API may still change. The frequent release history provides some compensating evidence of active development.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or write-token configuration. However, all 3 action references are unpinned, which is a workflow supply-chain hygiene gap.