ion-bazan/composer-diff

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All eight commits in the last three months came from one contributor, giving the project a single-person bus factor and increasing continuity risk.

Security policycaution

The repository has no security policy. This is a modest transparency gap for a package that runs as a Composer plugin, though the active repository and clear licensing provide some compensating context.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkout or script-injection findings, but all four action references are unpinned. The lack of a top-level permissions block is acceptable on its own; unpinned actions remain a supply-chain hygiene concern.