iqual/project-scaffold

Repo bus factorcaution

All 54 recent commits came from one contributor, leaving a concentrated maintenance path. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

The project uses Make and Composer, but no security-scanning tools were detected. That leaves a meaningful transparency gap for a package that executes as a Composer plugin.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Version stabilitycaution

This is an alpha prerelease of the 2.x line, so behavior and compatibility may still change even though prereleases are a minority of recent releases.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, and it does not grant top-level write permissions. However, all 9 action references are unpinned, creating avoidable build reproducibility and action-update risk.