mck89/peast

Maintainerscaution

Only one registry account has publish access, which is a modest publishing bus-factor concern for a user-owned project, though repository activity shows three active contributors.

Project backingcaution

The registry namespace and repository are owned by the same individual user, so there is no organization-level maintenance handoff to offset the small maintainer base.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a transparency gap, though it is not by itself evidence of unsafe maintenance.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although the active maintenance and test evidence provide some compensation.

Token permissionscaution

The only workflow lacks a top-level token-permissions declaration. No workflow requests top-level write access, but explicit least-privilege permissions would provide stronger CI hygiene.