sudiptpa/xero-php-sdk

Project backingcaution

The repository is owned by the same individual as the registry namespace, providing clear ownership, but it is user-backed rather than organization-backed and therefore offers limited maintenance redundancy.

Repo bus factorcaution

One contributor made all nine commits in the last three months, creating a real continuity risk for a user-owned project with no organizational backing.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; the strong test and CI evidence partly compensates for this transparency gap.

Token permissionscaution

The CI workflow lacks top-level token permissions and relies on job-level permissions, which is less explicit than a repository-wide read-only declaration but does not show any write permissions.