satag/doctrine-firebird-driver

Dangerous workflowscaution

Two of five analyzed workflows use pull_request_target, which warrants review because that trigger can expose elevated repository context to pull-request handling. However, no untrusted checkout or script-injection findings were detected.

Repo bus factorcaution

Only one contributor made all 97 commits in the last three months, creating a genuine continuity and bus-factor concern. Organization ownership provides some potential handoff capacity, but no second active contributor is shown by this signal.

Repo popularitycaution

The repository has only 3 stars and 1 fork, indicating limited external adoption; this is supporting caution rather than a health verdict because the package shows strong direct maintenance activity.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented. Other security tooling partially compensates for this transparency gap but does not eliminate it.

Token permissionscaution

Four workflows lack top-level permissions declarations, although none declares top-level write permissions and four use job-level permissions while one is read-only. The absence of explicit top-level defaults is a workflow-hardening gap, not evidence of excessive granted access.