picamator/transfer-object

Project backingcaution

The package and repository are owned by the same individual account, so the concentrated recent activity is not supported by organization-level handoff capacity.

Repo bus factorcaution

All 10 recent commits came from one contributor, leaving maintenance continuity concentrated in a single person.

Repo toolingcaution

Composer is used for builds, but no repository security scanning tools were detected; the absence is a modest transparency and maintenance gap, not evidence of unsafe code.

Workflow auditcaution

The workflow audit completed fully with no untrusted checkout, injection, or high-confidence audit findings, and job-level permissions are used. However, all 12 analyzed action references are unpinned, weakening build reproducibility.