antevemus/aspecification

Licensecaution

The manifest declares MIT, while the artifact detects MIT and Apache-2.0 across two license files. The package is licensed, but the declarations should be reconciled for clarity.

Release historycaution

The package is only 1 day old with four releases and a median release interval of about 5 hours. This shows active initial development but provides almost no long-term maintenance evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing scanner is a hygiene gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability reporting expectations unspecified for a library that exposes substantial application and database functionality.

Workflow auditcaution

Both workflows were analyzed successfully, use read-only permissions, and have no trigger or audit findings. However, all 12 referenced actions are unpinned, so their versions can change without a repository commit.