putyourlightson/craft-datastar

Repo bus factorcaution

One contributor made all commits in the last 3 months, creating concentration risk; the organization-owned repository provides some capacity to hand maintenance off.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months, indicating modest recent development activity, though the recent release history shows the project is not abandoned.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

Both workflows were analyzed without dangerous findings, untrusted checkouts, script injection, or excessive top-level permissions. All 4 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.