phplrt/parser-contracts

Repo bus factorcaution

All 25 recent commits came from one contributor, so maintenance continuity is concentrated in a single person despite the active project.

Security policycaution

The repository has no published security policy. This is a transparency gap, although the package is a small contracts library and no other provided signal shows a security incident.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all seven action references are unpinned, leaving a workflow supply-chain hygiene gap.