Package Health/borsche/elasticsearch-audit-bundle

borsche/elasticsearch-audit-bundle

Symfony bundle that records who changed what in your application into Elasticsearch: automatic Doctrine entity auditing, arbitrary domain events, coalescing of many small changes into one record, async writes through Messenger, and a filterable read API.

Latest v1.3.1

Packagist

61%

Total Score

caution

Unpinned workflows, high-confidence template-injection findings, and one-person maintenance make this a cautious dependency.

Health Score Breakdown

Project backing

The repository is owned by a user rather than an organization, so the one-person contributor concentration is not offset by visible organization backing.

Repo bus factor

All 357 commits in the last 3 months came from one contributor, giving the project a high concentration risk with no demonstrated handoff capacity.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected in the repository. The separate security policy and strong test coverage provide some transparency, but not automated vulnerability scanning.

Workflow audit

All 30 action references are unpinned, and the audit reports high-confidence template-injection findings plus secrets-inherit. No untrusted checkout or dangerous trigger was found, so these are serious workflow-hygiene concerns rather than an overall release-blocking risk.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Yliy Shcherbak

Direct Dependencies

Dependency	Last Release	Score
psr/log Version ^1.1.4 \|\| ^2.0 \|\| ^3.0	—	—
psr/clock Version ^1.0	—	—
symfony/config Version ^6.4 \|\| ^7.0 \|\| ^8.0	—	—
symfony/http-kernel Version ^6.4 \|\| ^7.0 \|\| ^8.0	—	—
psr/event-dispatcher Version ^1.0	—	—