webpatser/fledge-fiber

Project backingcaution

The registry and repository are owned by the same individual account, confirming package ownership but providing no organizational handoff or redundancy.

Repo bus factorcaution

All 38 recent commits came from one contributor, so maintenance continuity depends heavily on a single person despite the strong commit volume.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less clear for a package handling database, network, and filesystem integrations.

Workflow auditcaution

The sole workflow was fully analyzed and has two high-confidence unpinned-image findings. The audit found no untrusted checkout, script injection, or broad top-level write permissions, so this is a hygiene caution rather than a severe dependency risk.