iquesters/user-management

Repo bus factorcaution

Only one contributor made all 6 commits in the last 3 months, leaving maintenance dependent on a single person despite the repository being owned by an organization.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected, leaving security checks less transparent than they could be.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

The single workflow grants top-level write permissions and uses its only action reference without pinning. The audit found no untrusted checkout, script injection, or other concrete workflow finding, so this is a hygiene caution rather than a severe risk.