andersundsehr/phpstan-git-files

Lifecycle scriptscaution

The package declares a post-update-cmd lifecycle script; this adds some install-time behavior to review, although the signal does not show that it is unsafe or unusually broad.

Repo bus factorcaution

All 2 recent commits came from one contributor, so maintenance is concentrated; the organization-owned repository provides some handoff capacity but does not remove the continuity risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. For a small PHPStan extension this is a modest transparency gap rather than a severe concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.