phauthentic/cognitive-code-analysis

Repo bus factorcaution

One contributor made 100% of the one commit in the last 3 months. Organizational ownership partly offsets the concentration, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, indicating that source activity has slowed despite the recent release history.

Repo toolingcaution

The project uses Make, Composer, and Box for builds, but no security-scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so users are given no documented process for reporting or handling vulnerabilities.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence template-injection issue in phar-build.yaml. No untrusted checkout or script-injection sink was reported, so this is a hygiene risk rather than a standalone severe failure.