omisai/php-countries

Repo bus factorcaution

All 12 recent commits came from one contributor, so maintenance could be disrupted if that person becomes unavailable; organization ownership partly offsets this risk.

Workflow auditcaution

Both workflows were analyzed, but both action references are unpinned, one workflow grants top-level write permissions, and a high-confidence template-injection finding affects the release workflow. No untrusted checkout or script-injection trigger corroborates it, so this is a workflow hygiene concern rather than a severe standalone risk.