xp-forge/inject

Repo bus factorcaution

All three recent commits came from one contributor, creating a real continuity risk; organization ownership provides some handoff capacity but no second active contributor is shown.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected, leaving a modest supply-chain hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response procedures.

Workflow auditcaution

The only workflow was fully analyzed with no reported dangerous findings, but all 3 action references are unpinned; the missing top-level permissions block is acceptable on its own.