neophp-dev/neophp

Repo bus factorcaution

All 738 recent commits came from one contributor, so maintenance and release knowledge are concentrated in a single person. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. This is a modest transparency and maintenance gap rather than a standalone severe risk.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

All 12 analyzed action references are unpinned, and four workflows grant top-level write permissions; these create reproducibility and token-scope hygiene concerns. The audit found no untrusted checkout, script injection, or other reported findings, and all five workflows were analyzed.