symfony/ai-cerebras-platform

Repo bus factorcaution

All five recent commits came from one contributor, creating a real continuity risk. Symfony organization backing partly compensates because maintenance can be handed off, but no second active contributor is shown.

Repo package mentioncaution

The repository name matches the package, but its README does not mention the package name. That weakens package-to-repository transparency despite the matching repository identity.

Repo toolingcaution

The repository uses Composer, but no security scanning tool was detected. This is a modest transparency and maintenance gap rather than evidence of unsafe code.

Version stabilitycaution

v0.14.0 is not a prerelease, but the package remains below a stable major version, so API stability may be more limited than for a mature 1.x release.

Workflow auditcaution

The only workflow uses a pull_request_target trigger without an untrusted checkout or script injection, and the audit found no findings. However, its sole action reference is unpinned, which is a minor reproducibility and supply-chain hygiene gap.