humanmade/hm-url-tabs

Repo bus factorcaution

All three recent commits came from one contributor, creating a real continuity risk; organization ownership provides some ability to hand maintenance off but no second active contributor is shown.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less clear.

Workflow auditcaution

The audit found a high-confidence template-injection issue in the release workflow and 15 of 16 action references are unpinned. The low-confidence cache-poisoning finding is only a hygiene concern, and no untrusted trigger or checkout sink was reported.