querri/embed

Repo bus factorcaution

All four recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is evidenced, leaving a real maintenance concentration risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool is reported, leaving a project hygiene gap for a library handling API credentials and integrations.

Workflow auditcaution

All three workflows were analyzed without failed files or high-confidence findings, and no untrusted checkout or script-injection path was found. However, all five action references are unpinned and one workflow grants top-level write access, creating a moderate CI reproducibility and token-scope concern.