popphp/pop-db

Repo bus factorcaution

One contributor made all 39 commits in the last 3 months, representing a 100% top-contributor share. This is a genuine resilience concern, although the repository is owned by an organization, which provides some potential for maintenance handoff.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The build setup is appropriate, while the missing automated security scanning reduces assurance modestly.

Security policycaution

No repository security policy was found. This is a transparency and vulnerability-reporting gap, though it is not evidence that the package is unsafe by itself.

Token permissionscaution

The single workflow has no top-level permissions declaration. It does not request top-level write permissions, but explicitly declaring least-privilege permissions would provide stronger CI security hygiene.