matesofmate/phpstan-extension

Repo bus factorcaution

All 13 recent commits came from one contributor, creating a real continuity risk if that maintainer becomes unavailable. Organization backing partly offsets the risk but does not remove the concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. The missing automated security coverage is a maintenance and transparency gap, not evidence of compromise.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Version stabilitycaution

Version 0.7.1 is not a stable major release, but it is not a prerelease and recent versions have not used prerelease labels. This is a modest maturity limitation rather than a serious adoption risk.

Workflow auditcaution

The single workflow is fully analyzed with no audit findings or untrusted checkout and script-injection paths. However, it uses a top-level write token and its one action reference is unpinned, both of which are workflow hygiene weaknesses.