mpociot/teamwork

Project backingcaution

The repository is owned by the user account mpociot rather than an organization, so the two-account registry maintainer list does not receive organization-backing compensation; this is a modest bus-factor concern rather than a severe risk.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months. Although a release was published on the assessment date, the absence of recent commit activity is a genuine maintenance-continuity concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected, leaving a security-hygiene gap that is relevant but not severe on its own.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and response expectations.

Token permissionscaution

All three workflows lack top-level token permissions declarations, although none declares top-level write access and one uses job-level permissions; explicit least-privilege configuration would be preferable.