astrogoat/cashier

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the release history shows recent publishing, the lack of current source activity is a real maintenance concern.

Repo popularitycaution

The repository has zero stars and forks and only two watchers. Popularity is supporting evidence rather than a verdict, but these counts provide little independent evidence of broad review or community support.

Repo toolingcaution

The repository uses Composer build tooling but reports no security scanning tools. The missing scanner is a hygiene gap, not evidence that the package is unsafe by itself.

Workflow auditcaution

All three workflows use unpinned references, and the audit found a high-confidence, high-severity unpinned container image in php-cs-fixer.yml. The audit also had one failed file, so coverage is incomplete; no untrusted checkout or script-injection sink was found.