robrichards/xmlseclibs

Project backingcaution

The repository is maintained under an individual user account rather than an organization, so the concentrated contributor activity carries more weight than it would for organization-backed maintenance.

Repo bus factorcaution

Five contributors were active, but the primary maintainer made about 82% of recent commits, leaving meaningful concentration risk for a user-owned project.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected; this is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no security policy, making vulnerability reporting and disclosure expectations less clear despite the release containing detailed security hardening notes.

Token permissionscaution

The CI workflow does not declare top-level token permissions. No write permissions were detected, but explicit least-privilege declarations would provide stronger workflow hygiene.