marketdataapp/sdk-php

Project backingcaution

The repository is owned by the MarketDataApp user account rather than an organization, so the single-contributor concentration is not visibly offset by organization backing.

Repo bus factorcaution

One contributor made all 10 commits in the last three months, leaving maintenance and release continuity dependent on a single person.

Version stabilitycaution

v1.1.0 is a stable major release and is not a prerelease, although the high recent prerelease share makes the broader release pattern less consistent.

Workflow auditcaution

All six workflows were analyzed, but all 21 action references are unpinned and four workflows grant top-level write permissions. The audit also reports high-confidence bot-condition and template-injection findings, which are workflow hygiene concerns without an untrusted checkout or script-injection sink.