area17/twill-security-headers

Lifecycle scriptscaution

A post-autoload-dump install script runs during Composer installation. This is not inherently unsafe, but it expands install-time behavior and warrants review when maintenance activity is inactive.

Release historycaution

The package has 14 releases over about 3 years, but none in the last 12 months and the latest release was on December 3, 2024. This is meaningful evidence of stalled maintenance for a framework integration.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months, reinforcing the release-history evidence that current maintenance may have stopped.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and assurance gap, not a severe risk by itself.

Version stabilitycaution

The assessed release is marked stable and is not a prerelease, but the signal reports v1.0.9 as the latest version while the assessed release is v2.1.1. That inconsistency reduces release-history transparency.