vanilo/category

Repo bus factorcaution

All 3 recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown, leaving a real continuity concern.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy. This is a documentation gap for reporting and handling vulnerabilities, though it does not by itself indicate abandonment.

Workflow auditcaution

All 3 analyzed action references are unpinned, which weakens build reproducibility. The pull_request_target workflow has no untrusted checkout or script-injection sink, and the audit found no severity-rated findings.