bspdx/keystone

Lifecycle scriptscaution

Four Composer lifecycle scripts run during installation or updates, increasing integration and supply-chain complexity compared with a package without install-time behavior.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no security policy, making vulnerability reporting and response expectations less transparent for a package handling authorization.

Version stabilitycaution

Version v0.11.0 is not a stable major release, so compatibility may still change despite the absence of prerelease versions.

Workflow auditcaution

All four workflows were analyzed with no audit findings, but all 5 action references are unpinned and two workflows grant top-level write access; the pull_request_target trigger has no untrusted checkout or script-injection sink.