simplesamlphp/assert

Repo bus factorcaution

All 16 recent commits came from one contributor, giving the release a concentrated recent maintenance base. Organization backing partly offsets this, but it remains a continuity concern.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, although active maintenance and automated scanning provide some compensation.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script-injection findings, but all 23 action references are unpinned and high-confidence secrets-inherit findings appear twice. One workflow also grants top-level write access, creating a meaningful workflow-hygiene concern.