simplesamlphp/xml-cas

Repo bus factorcaution

All six recent commits came from one contributor, creating a concentrated maintenance path. Organization ownership partly offsets handoff risk, but no second active contributor is shown.

Security policycaution

The repository has no security policy file. This is a transparency gap for a library, although active security scanning provides some compensation.

Workflow auditcaution

All 23 analyzed action references are unpinned, and a high-confidence audit found secrets inherited by a reusable workflow. There are no untrusted checkouts or script-injection findings, but the workflow supply-chain hygiene remains a real concern.