visavi/rzd-api

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 24 recent commits came from one contributor, leaving maintenance dependent on a single person and increasing continuity risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a transparency and process gap, though it is not evidence of a vulnerability by itself.

Security policycaution

The repository has no security policy, so users have no documented security-reporting path or stated handling expectations.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 3 referenced actions are unpinned, which weakens build reproducibility and carries a hygiene risk.