jul6art/api-bundle

Maintainerscaution

Only one registry publishing account is listed, but repository activity shows a second active contributor, partly compensating for the narrow registry maintainer base.

Project backingcaution

The registry namespace and repository owner match, and the owner is an individual account; this is consistent ownership but offers less organizational maintenance depth.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported, leaving a modest repository hygiene gap.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout, injection, or audit findings. However, all 9 of 9 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.