simplesamlphp/xml-wss-core

Repo bus factorcaution

One contributor made 100% of the 8 recent commits. Organization ownership provides some handoff capacity, but no second active contributor is shown, so continuity depends heavily on one person.

Repo commit activitycaution

The repository received 8 commits in the last 3 months, showing ongoing work. However, all recent activity comes from one active maintainer, limiting resilience.

Security policycaution

The repository has no published security policy. For a security-focused WS-Security library, this is a meaningful transparency and vulnerability-reporting gap.

Workflow auditcaution

All 23 analyzed action references are unpinned, and the audit found two high-confidence medium-severity secrets-inherit findings; one workflow also has top-level write permissions. Workflows were fully analyzed with no untrusted checkout or script-injection findings, but the remaining hygiene and credential-scope issues lower the score.