leafs/leaf

Repo bus factorcaution

Recent activity is highly concentrated: one contributor made 23 of 24 commits. Organization backing provides some handoff capacity, but the observed contributor concentration remains a continuity concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest gap in ongoing dependency or code security hygiene.

Security policycaution

The repository has no SECURITY.md or other detected security policy, making vulnerability reporting less transparent for users and maintainers.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 5 action references are unpinned, which weakens build reproducibility and supply-chain control.