backdevs/dotenv-sniffer

Release historycaution

The package has had no registry release in over two years, despite 11 releases overall. This raises maintenance and abandonment concerns, though the repository was pushed more recently.

Repo commit activitycaution

There were no commits from active maintainers in the last three months, consistent with a quiet project and increasing the risk that issues will remain unresolved.

Repo issue activitycaution

Three issues and one pull request remain open, with no issues or pull requests closed in the last month. This is a modest sign of limited current maintenance rather than a severe failure.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, although the package is a small command-line tool.

Workflow auditcaution

All 15 analyzed action references are unpinned, and one workflow grants top-level write permissions. The reported cache-poisoning findings are low-confidence and therefore hygiene concerns only; no untrusted checkout or script-injection sink was found.