popphp/pop-cache

Repo bus factorcaution

One contributor made 14 of 15 commits in the last 3 months, creating a real concentration risk. A second contributor is active and the repository is organization-owned, which partly compensates but does not remove the concern.

Repo toolingcaution

The repository uses Composer, but no security scanning tool was detected. This is a security-process gap, though it is not evidence that the package is malicious or unmaintained.

Security policycaution

No repository security policy was found. That weakens vulnerability-reporting transparency, although active commits, tests, and current releases provide compensating maintenance evidence.

Token permissionscaution

The single analyzed workflow has no top-level token permissions declaration. No write permissions were detected, but explicitly limiting permissions would provide stronger CI security hygiene.