4lxndr/cron-bundle

Maintainerscaution

Only one registry publishing account is listed, which limits publishing redundancy. The repository is owned by the same individual and recent release activity provides some compensating evidence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a meaningful maintenance concern, even though the package had a release during the broader observed period.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a package that integrates deeply with Symfony and Doctrine.

Workflow auditcaution

All three workflow action references are unpinned, which weakens build reproducibility. The reported cache-poisoning finding has low confidence and is hygiene rather than an independent severe risk; the audit itself completed fully with no untrusted checkout or script-injection findings.