linkrobins/auto-lock

Release historycaution

This is a new package, only 38 days old, with one release and no established release cadence. That limits evidence of long-term maintenance but is partly offset by recent repository activity.

Repo bus factorcaution

Two contributors were active, but one accounts for about 78% of commits. Organization ownership provides some handoff capacity, so this is a modest concentration concern rather than a severe risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a transparency and hygiene gap, not evidence of unsafe behavior by itself.

Security policycaution

The repository has no security policy. For a new package this reduces disclosure transparency, though the other provided signals show a real source repository and active development.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both of the two action references are unpinned, which leaves a modest reproducibility and supply-chain hygiene gap.