It also has clear documentation, an explicit MIT license, and a small dependency surface. The organization-backed project has two recent contributors, while all five workflow actions remain unpinned.
84%
Total Score
100
100
93
83
Composer build tooling is present, but no security scanning tool was detected. The missing scanner is a minor transparency gap, not evidence of unsafe maintenance by itself.
The repository has no security policy, leaving vulnerability-reporting expectations unspecified. This is a modest transparency gap for a package intended to be consumed as a library.
Both workflows were fully analyzed with no untrusted checkouts, script injection, or high-severity findings, and one scopes permissions at job level. However, all five action references are unpinned, which creates a minor reproducibility and workflow supply-chain hygiene gap.
We didn't find any vulnerabilities for this package.
No direct dependencies.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.