voku/phpdoctor

Workflow auditdanger

Both workflows scope permissions at job level, but all 12 action references are unpinned and the release workflow has two high-confidence template-injection findings. The release automation therefore warrants remediation before relying heavily on its published artifacts.

Maintainerscaution

Only one registry account has publishing access. The repository is user-owned rather than organization-owned, so there is no organizational backing shown to offset that concentration.

Project backingcaution

The registry namespace and repository are owned by the same individual, which supports repository identity but does not provide organizational redundancy.

Repo bus factorcaution

All 11 recent commits came from one contributor, leaving maintenance and release knowledge concentrated in a single person.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response guidance unclear.