andrecorugda/ai-openrouter-gateway

Project backingcaution

The package and repository are owned by the same individual account, so the source relationship is clear. Individual ownership provides less demonstrated maintenance capacity than organizational backing, especially alongside limited activity evidence.

Release historycaution

There are 24 releases in 88 days, but the median interval is about 7 minutes and the releases are concentrated in the initial launch period. That rapid burst suggests an immature release process rather than established maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are reported. For a package handling API credentials and application data, the missing scanning coverage is a modest transparency gap.

Security policycaution

The repository has no security policy. That does not show a defect, but it leaves vulnerability-reporting and maintenance expectations undocumented for an integration that handles AI credentials and user data.

Workflow auditcaution

The only workflow was fully analyzed with no injection or high-severity findings, but both of its two action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own; unpinned actions remain a supply-chain hygiene concern.