pushinbr/pam-native-testing

Repo bus factorcaution

One contributor made 100% of the recent commits; organization ownership provides some handoff capacity, but the observed maintainer base remains narrow.

Repo commit activitycaution

Fifteen commits in the last three months show active work, but all activity came from one maintainer.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less clear for consumers.

Workflow auditcaution

Both workflows use read-only permissions and have no untrusted checkout, injection, or auditor findings. However, all three analyzed action references are unpinned, weakening build reproducibility and supply-chain hygiene.