hyperlinkgroup/linguist

Lifecycle scriptscaution

The package uses a post-autoload-dump install lifecycle script. This is a supply-chain-sensitive behavior and merits some caution because its exact actions are not shown here.

Repo bus factorcaution

All 19 recent commits came from one contributor, leaving maintenance dependent on a single active individual. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool is reported; this is a modest transparency and assurance gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

The single workflow was fully analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 10 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.