slothsoft/amber

Repo bus factorcaution

All 2 recent commits came from one contributor, leaving maintenance continuity dependent on a single active developer.

Repo commit activitycaution

The repository had 2 commits in the last 3 months, showing recent activity, but the volume is modest for a package with ongoing releases.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected, leaving a preventable review gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All 16 analyzed action references are unpinned, and one workflow grants top-level write permissions. The audit found no untrusted checkout or script-injection paths, so this is workflow hygiene risk rather than a severe exposure.