j0k3r/graby

Dependency profilecaution

The package declares 18 runtime dependencies, which increases maintenance and transitive-risk surface, though the dependency set is consistent with a web-content extraction library requiring HTTP, parsing, and logging components.

Repo bus factorcaution

The top contributor made about 71% of recent commits, creating some concentration risk, although three other contributors were active during the same period.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; this is a transparency and process gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear and modestly reducing project transparency.

Token permissionscaution

Both workflows omit top-level token permissions, so their permissions are less explicitly constrained than recommended; neither workflow declares top-level write access.