phpstreamserver/http-server

Dangerous workflowscaution

The sole workflow uses pull_request_target, which can expose privileged workflow behavior to untrusted pull requests even though no untrusted checkout or script injection was detected. This is a repository security concern.

Dependency profilecaution

Ten runtime dependencies, including core framework, event-loop, socket, and extension requirements, create a relatively broad dependency surface. This is plausible for an HTTP server but increases transitive maintenance and compatibility exposure.

Maintainerscaution

Only one account has registry publish access, which is a concentration risk in isolation. The organization-owned repository provides some backing, so this is caution rather than a severe risk.

Package scaffoldingcaution

A README is present, but neither the artifact nor repository has tests or a changelog. For an asynchronous HTTP server, the absence of visible tests is a genuine verification and maintenance gap.

Repo bus factorcaution

One contributor made all 13 commits in the last 3 months, creating a very low bus factor. Organization ownership offers potential handoff capacity, but no second active contributor is evidenced.