popphp/pop-queue

Repo bus factorcaution

All 111 recent commits came from one contributor, leaving limited visible contributor redundancy. Organization backing reduces handoff risk somewhat, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a maintenance and supply-chain hygiene gap, not evidence that the release is unsafe.

Security policycaution

The repository has no security policy. For a queue component that handles jobs and payloads, this reduces transparency around vulnerability reporting and response.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, but all four action references are unpinned. Unpinned actions weaken build reproducibility, so this is a hygiene caution.