leafs/cli

Repo bus factorcaution

One contributor made all 35 commits in the last 3 months, creating a real continuity risk if that person becomes unavailable. Organization backing partly compensates by providing a potential handoff path, so this is caution rather than danger.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools are reported. This is a modest supply-chain hygiene gap in an otherwise actively maintained project.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations unclear. This lowers transparency but is not by itself evidence of abandonment.

Token permissionscaution

Neither workflow declares top-level token permissions, so the repository does not explicitly constrain GitHub Actions token access. No write-enabled workflow was detected, making this a hygiene concern rather than a severe workflow risk.