league/route

Repo bus factorcaution

All six recent commits came from one contributor, so maintenance capacity is concentrated and continuity depends heavily on that person. Organization backing provides some handoff capacity but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. The missing scanning layer is a modest transparency and maintenance gap, not evidence of unsafe code.

Security policycaution

The repository has no security policy. That weakens the project's documented vulnerability-reporting process, although it does not indicate abandonment on its own.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkout, injection, or audit findings, and it has no top-level write permissions. However, all six action references are unpinned, leaving builds exposed to action changes over time.