shlinkio/shlink-php-sdk

Repo bus factorcaution

One contributor made all 5 commits in the last 3 months, creating a real concentration risk. Organization backing partly offsets the risk because maintenance can potentially be handed off within the project.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. This is a modest transparency gap rather than a severe risk because other project and workflow evidence is available.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 4 of 4 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.