askdkc/bacon-qr-code

Release historycaution

Only one release is recorded, and no release has appeared in over two years. That gives the package a meaningful abandonment risk despite the stable version.

Repo commit activitycaution

The repository had no commits and no active maintainers in the last three months. Together with the single-release history, this is evidence of stalled maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That is a modest transparency and maintenance gap for a dependency package.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The workflow audit completed cleanly with no reported findings or untrusted checkouts, but all six action references are unpinned. That weakens build reproducibility and supply-chain hygiene without making the package unfit on its own.