agence104/livekit-server-sdk

Licensecaution

The manifest declares MIT, while the artifact license file is detected as Apache-2.0. Although a license file exists, the mismatch creates a genuine licensing ambiguity for adopters.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tool was detected. This is a minor transparency gap, partly offset by the release notes describing a dependency security fix.

Security policycaution

The repository has no published security policy. That reduces transparency for reporting vulnerabilities, though the release notes show that security maintenance does occur.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, but all 4 of 4 action references are unpinned. This is a supply-chain hygiene gap rather than a severe risk on its own.