humanmade/hm-query-loop

Repo popularitycaution

The repository has only 7 stars and no forks, indicating limited adoption, but popularity is supporting evidence and does not outweigh the strong maintenance signals.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest transparency and defensive-hygiene gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and handling expectations undocumented.

Version stabilitycaution

This release is not a prerelease, although the package remains below a stable major version, so compatibility expectations may be less settled.

Workflow auditcaution

All five workflows were analyzed without untrusted triggers or script-injection sinks, but 9 of 12 action references are unpinned. A high-confidence template-injection finding in the release workflow is a meaningful release-process hygiene concern; the low-confidence cache finding is only minor.