surfnet/stepup-gssp-bundle

Repo bus factorcaution

All 3 recent commits came from one contributor, leaving maintenance dependent on a single active individual despite organization ownership.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no documented security policy, which reduces transparency for reporting and handling vulnerabilities in a security-sensitive SAML bundle.

Version stabilitycaution

This is a prerelease beta, which adds some adoption risk, although it is the latest version and prereleases represent only 15% of recent releases.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers, untrusted checkouts, or audit findings. However, all 3 action references are unpinned, weakening build reproducibility; missing top-level permissions are not harmful on their own.