spaze/phpstan-disallowed-calls

Repo bus factorcaution

One contributor made all nine commits in the last three months, so maintenance depends heavily on a single person. The project is user-owned rather than organization-owned, providing no shown organizational handoff cushion.

Security policycaution

The repository has no published security policy. That is a transparency gap for reporting vulnerabilities, although the package's active development and dependabot scanning provide some compensating evidence.

Workflow auditcaution

Both workflows were analyzed, but all 8 action references are unpinned, weakening build reproducibility. The audit also found two high-confidence template-injection findings; without an untrusted trigger or checkout sink, these remain workflow hygiene concerns rather than standalone severe risk.