milpa/ai-gateway

Repo bus factorcaution

One contributor made all 89 commits in the last three months, creating a clear single-person continuity risk. Organization ownership provides some handoff capacity but does not remove the lack of an independently active contributor.

Repo commit activitycaution

The repository recorded 89 commits in three months, showing active development, but all were made by one active maintainer.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a modest transparency and maintenance gap rather than evidence of an unsafe release.

Version stabilitycaution

v0.42.1 is not marked prerelease and recent releases have no prerelease share, but the 0.x major version means the API is not yet at major-version stability.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkout, script injection, or auditor findings. However, all 8 action references are unpinned and three workflows grant top-level write permissions, creating reproducibility and least-privilege concerns without a dangerous trigger-and-sink combination.