leafs/session

Repo bus factorcaution

Only one contributor made all six recent commits, creating a narrow maintenance base. Organization backing partly compensates because maintenance can potentially be handed off, but the current concentration remains a caution.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small package this is a transparency and monitoring gap rather than a severe dependency risk.

Security policycaution

The repository has no published security policy. That weakens vulnerability-reporting transparency, although it does not by itself indicate abandonment or unsafe code.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or audit findings, and neither grants top-level write permissions. However, all four referenced actions are unpinned, leaving workflow builds exposed to action changes over time.