vdb/php-spider

Project backingcaution

The repository is owned by an individual account rather than an organization. That is compatible with a healthy small project, but it provides no organizational redundancy to offset the concentrated recent activity.

Repo bus factorcaution

One contributor made all 3 recent commits, giving the project a very high short-term concentration risk. The repository is individually owned, so there is no shown organizational backing to compensate for this.

Repo commit activitycaution

There were 3 commits in the last 3 months, showing recent work, but all activity came from only one active maintainer. The cadence is adequate but not broad.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is not by itself evidence that the package is unsafe to use.

Token permissionscaution

Neither workflow declares top-level token permissions, although no workflow requests top-level write access and one uses job-level permissions. Explicit least-privilege declarations would make the CI supply chain clearer.