slothsoft/minecraft

Repo bus factorcaution

One contributor made all recent commits, leaving maintenance dependent on a single active person with no demonstrated handoff capacity.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing continued activity but a very limited recent maintenance cadence.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving security hygiene less visible.

Security policycaution

The repository has no security policy, so there is no stated process for reporting or handling vulnerabilities.

Workflow auditcaution

Both workflows were analyzed without high-confidence findings or untrusted-trigger sinks, but all 11 action references are unpinned and one workflow grants top-level write access, creating avoidable workflow supply-chain exposure.