xp-framework/rdbms

Repo bus factorcaution

All 10 recent commits came from one contributor, giving the project a single-person operational dependency. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer is used for builds, which fits the package ecosystem, but no security scanning tools are reported. This is a modest transparency gap rather than evidence of unsafe maintenance.

Security policycaution

The repository has no security policy. For a database access library this reduces clarity about vulnerability reporting and response, though it does not by itself indicate abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. All 3 of 3 action references are unpinned, leaving avoidable update and supply-chain hygiene risk.