bitly-api/sdk

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script runs during Composer operations. This adds some install-time behavior that should be understood, though the signal does not show a dangerous action.

Release historycaution

There have been eight releases, but none in the last 12 months and the latest registry release was about one year ago. This indicates materially slowed maintenance for a library that may need API updates.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months. Combined with no registry releases in about a year, this raises maintenance and abandonment concerns.

Security policycaution

No repository security policy was found, leaving users without a documented reporting path or published security process.

Workflow auditcaution

All six workflows were analyzed, but all 15 action references are unpinned, and one high-confidence bot-conditions finding was reported. Four workflows also grant top-level write permissions; with no untrusted checkout or script-injection findings, this is workflow hygiene risk rather than a severe standalone failure.