phplrt/source-contracts

Repo bus factorcaution

All 23 recent commits came from one contributor, creating a concentrated maintenance dependency. Organization backing partly compensates because the project can potentially hand work to another maintainer.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For this small focused package, that is a modest assurance gap rather than evidence of unfitness.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This lowers transparency but is not severe enough to outweigh the active project evidence.

Workflow auditcaution

Both workflows were analyzed successfully with no reported audit findings, no untrusted checkouts, and no script injection. However, all 7 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.