horde/css_parser

Repo bus factorcaution

All three recent commits came from one contributor, leaving no demonstrated second active contributor to share maintenance. Organizational ownership helps with handoff potential but does not remove the observed concentration.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected in the repository. This is a modest transparency and maintenance gap rather than evidence of unsafe code.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed successfully with no injection or high-severity findings, and one scopes permissions at job level. However, six of seven action references are unpinned, which weakens build reproducibility and supply-chain hygiene.