php-collective/code-sniffer

Repo bus factorcaution

One contributor made all 14 commits in the last three months, creating a concentrated maintenance dependency. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer is used for builds, but no security scanning tool is reported. For a coding-standard package this is a modest transparency and assurance gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. This slightly reduces transparency for reporting and handling vulnerabilities, though the active release history partly offsets the concern.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, but all 9 action references are unpinned. That leaves build inputs less reproducible and is a workflow hygiene concern.