staabm/phpstan-todo-by

Dangerous workflowscaution

One of six analyzed workflows contains a script-injection finding, creating a concrete automation hygiene concern even though no pull-request-target, workflow-run, or untrusted-checkout risks were detected.

Project backingcaution

The registry namespace and repository owner match, and the owner is an individual user. This supports ownership continuity but provides no organization-level handoff capacity.

Repo bus factorcaution

All recent commits came from one contributor, giving the project a concentrated maintenance base. The repository is user-owned rather than organization-owned, so there is no provided organizational backing to offset this concentration.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, with 1 active maintainer. The recent release and release notes provide some compensating evidence, but current maintenance capacity appears thin.

Repo issue activitycaution

There are 10 open issues and 4 open pull requests, but no issues or pull requests were opened or closed in the last month, indicating limited recent project activity.