xelon-ag/vmware-php-client

Repo bus factorcaution

All 3 recent commits came from one contributor, creating a real continuity risk if that person becomes unavailable. Organizational ownership partly offsets this by providing a broader maintenance handoff path.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All 12 analyzed action references are unpinned, weakening reproducibility and action supply-chain control. The audit also found a high-confidence bot-condition issue in a pull_request_target workflow with top-level write permissions; no untrusted checkout or script injection was detected, so this is a hygiene concern rather than a standalone severe risk.