silverorange/building

Repo bus factorcaution

One contributor made all 7 commits in the last 3 months, concentrating maintenance in a single person. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

The project uses Composer for builds, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, reducing clarity about how vulnerabilities should be reported and handled.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts or script injection, but all 5 action references are unpinned and it installs a package outside a lockfile. These are hygiene concerns rather than severe risks because no dangerous trigger or write token was found.