nycorp/shortext-php

Workflow auditdanger

All 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The audit found no untrusted checkout or script-injection sinks, which limits the severity but does not remove the hygiene risk.

Maintainerscaution

Only one account has registry publishing access. The repository is user-owned rather than organization-owned, so the short maintainer base is a genuine continuity concern.

Project backingcaution

The source repository is owned by a user account rather than an organization, so the single-contributor and single-publisher concentration is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all commits in the last three months, leaving maintenance fully concentrated in a single person with no provided organizational backing.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development despite the package's recent release activity.