sobhansgh/rubikabotphp

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Release historycaution

The package is only 91 days old with three releases, clustered within about one hour, and no release after June 22 despite assessment in September. This leaves sustained maintenance unproven.

Repo bus factorcaution

One maintainer made all eight commits in the last three months, leaving the project dependent on a single person for ongoing maintenance.

Repo toolingcaution

Composer and Make are used for build support, but no security scanning tools are reported. This is a modest build-hygiene gap rather than a severe risk.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-confidence audit findings, but both action references are unpinned. The lack of a top-level permissions block is acceptable here because no write-wide permissions were observed.