jul6art/audit-bundle

Maintainerscaution

Only one registry account can publish the package, which is a modest publishing concentration concern, though repository activity shows a second active contributor.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected; the repository's security policy provides some compensating process transparency.

Workflow auditcaution

The only workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or injection findings. However, all 9 action references are unpinned, weakening build reproducibility and update integrity.