simplesamlphp/xml-common

Repo bus factorcaution

One contributor made about 92% of the recent commits, leaving substantial concentration risk. The second contributor remains active and the organization backing provides some handoff capacity, so this is a caution rather than a severe risk.

Security policycaution

The repository has no published security policy, so users lack clear documented guidance for reporting vulnerabilities or understanding the project's response process.

Workflow auditcaution

All three workflows were analyzed, but all 23 action references are unpinned, and the audit found two high-confidence medium-severity secrets-inherit findings; one workflow also has top-level write permissions. These are meaningful workflow hygiene and credential-scope concerns, though no untrusted checkout or script injection was found.