silarhi/picasso-bundle

Repo bus factorcaution

All two recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown to offset the concentration.

Repo commit activitycaution

Only two commits were recorded in the last three months, which is thin activity for a package that is still releasing regularly and warrants maintenance caution.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so its process for receiving and documenting vulnerability reports is unclear.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both analyzed action references are unpinned, which is a workflow supply-chain hygiene caution.