slothsoft/schema

Repo bus factorcaution

All four recent commits came from one contributor, so maintenance depends entirely on a single person and has limited handoff resilience.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a modest transparency and assurance gap rather than evidence of unsafe code.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

Both workflows were analyzed without high-severity findings or untrusted checkouts, but all 11 action references are unpinned and one workflow grants top-level write access, creating avoidable maintenance and workflow-integrity risk.