popphp/pop-http

Repo bus factorcaution

All 19 recent commits came from one contributor, creating concentration risk; the organization-owned project provides some compensation because maintenance can be handed off internally.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response procedures unclear.

Workflow auditcaution

The complete audit found a high-confidence unpinned container image and all 3 action references are unpinned. No untrusted checkout, script injection, or broad top-level write permission was observed, so this is a hygiene caution rather than a severe dependency risk.