activeledger/sdk

Repo bus factorcaution

All 17 commits in the last three months came from one contributor, leaving maintenance concentrated; organization ownership provides some handoff capacity but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a meaningful repository hygiene gap for a cryptographic SDK.

Security policycaution

The repository has no security policy, reducing transparency for reporting vulnerabilities in a package that handles keys and signed transactions.

Workflow auditcaution

Both workflows were analyzed successfully, but all five action references are unpinned, the release workflow has broad top-level write permissions, and it contains five high-confidence template-injection findings. No untrusted checkout or script-injection trigger was reported, so this is a hygiene and hardening concern rather than a standalone critical finding.