siganushka/doctrine-contracts

Project backingcaution

The repository is owned by an individual account rather than an organization, so the one-person contributor concentration is not visibly offset by broader project backing.

Repo bus factorcaution

All three recent commits came from one contributor, so maintenance continuity depends entirely on a single individual.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tools were detected; for this small PHP library, that is a modest transparency gap rather than a severe risk.

Security policycaution

No repository security policy was found. This limits documented vulnerability-reporting guidance, although the package is a small set of abstractions rather than a large application.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both action references are unpinned, weakening build reproducibility.