vanilla/garden-schema

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second recently active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, indicating limited recent source activity even though the release history is strong.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a modest transparency and maintenance gap rather than a standalone severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The workflow audit completed cleanly, uses read-only permissions, and found no injection or high-severity issues. However, both analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.