bepsvpt/secure-headers

Clear documentation, repository tests, and a recent stable release support dependable maintenance. Workflow pinning and security-process gaps remain, but recent commits from two contributors and an active repository reduce abandonment concerns.

Latest 9.1.1

Packagist

80%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo tooling

Composer build tooling is present, but no security scanning tool was detected. For a package focused on HTTP security headers, that is a process gap, though it is not evidence of unsafe code by itself.

Security policy

The repository has no security policy, leaving disclosure and response expectations undocumented for a security-oriented package.

Workflow audit

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but all six action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own; the unpinned actions remain a supply-chain hygiene concern.