bretto36/csp-reporting

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. This is compatible with a small package, but it offers less visible organizational backing if maintenance stops.

Release historycaution

This package has only one release, published about 20 months ago, with no releases in the last 12 months. That limits evidence of sustained maintenance, although the linked repository is not archived.

Repo commit activitycaution

There were no commits and no active maintainers in the three months before collection. Combined with only one registry release, this is a meaningful maintenance and abandonment concern.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tool was detected. This is a modest transparency and hygiene gap, not evidence that the package is unsafe to depend on.

Security policycaution

The repository has no security policy. For a package handling CSP reports, that reduces clarity about how vulnerabilities would be reported and maintained.