bentonow/bento-php-sdk

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months; combined with the old latest release, this indicates stalled maintenance.

Release historycaution

The package has five releases since January 2022, but none in the 12 months before assessment; the latest release was about 20 months ago, which raises maintenance risk.

Repo toolingcaution

Composer is used for the build, but no security scanning tools were detected, leaving a security-hygiene gap in the repository.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

All 10 action references are unpinned, and one workflow has top-level write permissions, creating avoidable workflow-maintenance risk. The high-confidence template-injection finding is not corroborated by an untrusted trigger or checkout, so it remains hygiene rather than a severe workflow risk.