uften/courier

Project backingcaution

The repository is owned by a user account rather than an organization, so the single-contributor activity is not backed by an evident organizational handoff structure.

Repo bus factorcaution

All four recent commits came from one contributor, giving the project a single-person maintenance dependency. There is no provided evidence of a second active contributor to compensate for that concentration.

Repo toolingcaution

Composer build tooling is used, but no security scanning tool was detected. The missing scanner is a transparency and maintenance-process gap, not evidence of an unsafe release by itself.

Security policycaution

The repository has no security policy. For a package integrating external courier APIs, this weakens published guidance for reporting and handling security issues.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all four action references are unpinned, so their versions can change unexpectedly.