horde/perms

Dependency profilecaution

Eight runtime dependencies create meaningful dependency surface for a library, though they are aligned with the Horde and PSR ecosystem rather than an unusually broad or opaque set.

Repo bus factorcaution

All 6 recent commits came from one contributor, so maintenance is vulnerable to that contributor becoming unavailable. Organization backing partly offsets the risk but does not remove the concentration.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no published security policy, making vulnerability reporting and response expectations less clear.

Workflow auditcaution

Both workflows were analyzed successfully with no reported audit findings, no untrusted checkouts, and no script-injection sinks. However, 6 of 7 action references are unpinned, which is a workflow reproducibility and supply-chain hygiene weakness.