jramke/fluid-primitives

Repo bus factorcaution

The top contributor made 71% of recent commits, but two additional contributors were active, including one with 25%. This is a concentration caution rather than a severe single-maintainer risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a modest transparency and preventive-hygiene gap, not evidence of unsafe code.

Security policycaution

The repository has no security policy. This makes vulnerability reporting less clear for a component library, though it does not indicate abandonment by itself.

Workflow auditcaution

All 3 workflows were analyzed with no untrusted checkout or script-injection findings. However, all 7 action references are unpinned, one workflow grants top-level write access, and a low-confidence cache-poisoning pattern was reported; these are workflow-hygiene cautions, not standalone severe risks.