manuxi/sulu-event-bundle

Maintainerscaution

Only one account has registry publish access, which creates some publishing concentration. Repository activity shows two active contributors, partly compensating for that registry-side limitation.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. That limits formal handoff capacity, though recent activity from two contributors provides some compensation.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This lowers transparency but is not severe for the overall health assessment.

Workflow auditcaution

Both workflows were fully audited, use read-only permissions, and contain no high- or medium-confidence findings. However, 4 of 5 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.