webproject-xyz/docker-api-client

Dangerous workflowscaution

Both workflows were analyzed with no script injection or pull_request_target findings, but the release workflow contains an untrusted checkout in a workflow_run context, creating a meaningful workflow-hardening concern.

Repo popularitycaution

Two stars, zero forks, and one watcher indicate very limited external adoption and independent review. Popularity is supporting evidence rather than a verdict, so this is a caution rather than a severe health failure.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning lowers supply-chain transparency somewhat, though it is not by itself evidence of an unhealthy package.

Security policycaution

The repository has no SECURITY.md or equivalent security policy, leaving vulnerability-reporting and response expectations unclear.

Token permissionscaution

The release workflow lacks top-level token permissions, and the CI workflow declares top-level write permissions; these defaults are broader or less explicit than ideal and warrant workflow review.