phplrt/source

Repo bus factorcaution

All 25 recent commits came from one contributor, so maintenance continuity depends heavily on a single person; organization backing provides some handoff capacity but does not remove the concentration risk.

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tool is configured; this is a modest transparency and defense-in-depth gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance undocumented.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers or audit findings, but all 7 action references are unpinned, which weakens reproducibility and supply-chain hygiene; the lack of top-level permissions is acceptable on its own.