portphp/xml

Repo bus factorcaution

All two recent commits came from one contributor, concentrating short-term maintenance responsibility. Organization backing partly reduces handoff risk, but the concentration remains a caution.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations less clear for users and maintainers.

Workflow auditcaution

The single workflow has read-only permissions and no detected dangerous triggers or audit findings, but all three action references are unpinned, weakening build reproducibility.