lullabot/drainpipe-dev

Dangerous workflowscaution

One of two workflows uses pull_request_target, which requires careful privilege handling, although no untrusted checkout or script-injection pattern was detected.

Repo bus factorcaution

All recent commits come from one contributor, leaving no demonstrated contributor redundancy; organization ownership provides some handoff capacity but does not replace observed activity from a second maintainer.

Repo commit activitycaution

Only one commit was made in the last 3 months by one active maintainer, so current maintenance capacity is thin despite the strong release history.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a transparency and detection gap.

Security policycaution

The repository has no security policy, so the process for reporting and handling vulnerabilities is not documented.