bartlett/sarif-php-sdk

Lifecycle scriptscaution

A post-autoload-dump script runs during Composer installation. This adds some execution surface, but the signal does not show suspicious behavior or an unusually broad script set.

Project backingcaution

The repository owner is an individual rather than an organization, so the single registry maintainer represents a relatively thin ownership base. Recent releases and repository activity provide partial compensation.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The April 22, 2026 release partly offsets this, but the current activity gap still raises maintenance concern.

Repo toolingcaution

Composer and Box provide build tooling, but no security-scanning tool was detected. The missing scanning coverage is a modest transparency and maintenance gap, not evidence of a defect.

Security policycaution

The repository has no security policy. This weakens disclosure transparency for a library, although the strong documentation and release process provide some compensating project evidence.