nickdekruijk/leap

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends more directly on the small observed contributor base; current activity provides meaningful compensation.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest verification gap for a package handling authentication, permissions, and uploads.

Security policycaution

The repository has no security policy, which reduces transparency for reporting vulnerabilities in a package that includes authentication and permission features.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkout or script-injection findings, but all five action references are unpinned and one release workflow has top-level write permissions, creating workflow hygiene and least-privilege concerns.