team-reflex/discord-php

Dependency profilecaution

The release declares 20 runtime dependencies, which adds integration surface and transitive maintenance exposure, but the dependencies are explicitly declared rather than hidden.

Repo bus factorcaution

One contributor made about 81% of the recent commits, creating concentration risk, although four other contributors were active and the repository is backed by an organization.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less clear despite its security scanning tools.

Workflow auditcaution

All seven workflows were analyzed without dangerous triggers, untrusted checkouts, or audit findings, and most use read-only permissions. However, all 18 action references are unpinned and one workflow has top-level write permissions, creating a build-integrity and least-privilege concern.