popphp/pop-acl

Repo bus factorcaution

All 9 recent commits came from one contributor, giving the project a low independent review and handoff capacity. Organization backing partly compensates, but does not eliminate the continuity concern.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tools were detected. For an access-control library, that is a meaningful transparency and maintenance gap.

Security policycaution

The repository has no security policy. This leaves vulnerability reporting and disclosure expectations unclear for a security-relevant authorization component.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted execution sinks, but all 3 action references are unpinned. The absence of a top-level permissions block is acceptable on its own, while unpinned actions remain a modest reproducibility and supply-chain hygiene concern.