nostriphant/nip-01

Repo bus factorcaution

All four commits in the last three months came from one contributor, leaving maintenance dependent on a single active person. Organization ownership provides some backing, but no second recent contributor is shown.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool is reported. This is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no security policy, so users are not given a documented channel or process for reporting vulnerabilities.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Its single action use is unpinned, which is a supply-chain hygiene gap, while the absence of a top-level permissions block is acceptable on its own.