ycodetech/valet-windows

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated contributor activity is not offset by visible organization backing. This reinforces the bus-factor concern.

Repo bus factorcaution

One contributor made 5 of 6 recent commits, or about 83%, while only two contributors were active. This concentration creates a meaningful continuity risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a package that ships a development environment and executable components, this is a moderate transparency gap.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although it does not by itself show abandonment or unsafe code.

Workflow auditcaution

All 11 analyzed action references are unpinned and all three workflows grant top-level write permissions; high-confidence template-injection findings also appear in release and changelog workflows. No untrusted checkout or script-injection trigger was found, so this is workflow hygiene risk rather than a standalone severe health failure.