luzrain/telegram-bot-api

Project backingcaution

The repository and package are owned by the same individual account rather than an organization. This matches the concentrated recent commit activity and provides no organizational handoff evidence.

Repo bus factorcaution

One contributor made 13 of 14 recent commits, or about 93%, while the second made 1. The active second contributor provides some backing, but maintenance remains heavily concentrated.

Security policycaution

No SECURITY.md or equivalent security policy was found. For a maintained API client this is a transparency gap, although active commits and Psalm scanning provide partial compensation.

Workflow auditcaution

The only workflow was fully analyzed with no failed files, dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both of its action references are unpinned, leaving a build-integrity hygiene gap.