kematjaya/crud-maker-bundle

Project backingcaution

The repository is owned by a user account rather than an organization, so the small contributor base has less formal project-backing compensation.

Repo bus factorcaution

Two contributors are active, but the leading contributor made about 67% of recent commits, leaving some concentration risk despite meaningful secondary participation.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

All six analyzed action references are unpinned, and the publish workflow installs a package outside a lockfile; these weaken reproducibility, while the low-confidence cache-poisoning finding is hygiene rather than a severe risk.