webfactory/wfdmeta-bundle

Repo bus factorcaution

All two recent commits came from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown, leaving maintenance concentrated.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent even though the repository otherwise appears purpose-specific.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving automated security coverage unclear.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All three workflows were analyzed without high-severity findings or untrusted-code sinks, but all eight action references are unpinned, weakening build reproducibility and update control.