popphp/pop-dom

Repo bus factorcaution

All 9 recent commits came from one contributor, creating a genuine continuity risk; organization backing provides some capacity to hand off maintenance but does not remove the concentration.

Repo toolingcaution

Composer build tooling is used, but no security-scanning tooling was detected, leaving security review less automated.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous audit findings or untrusted checkouts, but all 3 action references are unpinned, creating avoidable reproducibility and action-substitution exposure.