php-soap/psr18-attachments-middleware

Repo bus factorcaution

All 21 recent commits came from one contributor, creating a real continuity risk; organization backing provides some capacity for handoff but does not remove the concentration.

Security policycaution

The repository has no published security policy, which weakens vulnerability-reporting transparency, though active development and automated scanning partly compensate.

Workflow auditcaution

All four workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 7 action references are unpinned, leaving avoidable build reproducibility and action-integrity risk.