byteshard/core

Dependency profilecaution

The package declares 36 runtime dependencies, including several related internal packages and substantial external libraries. This increases upgrade and compatibility burden, though it is not by itself evidence of poor maintenance.

Package scaffoldingcaution

A changelog, contribution guidance, and GitHub Releases are present, but neither the artifact nor repository contains tests. For a substantial library, that is a meaningful transparency and maintenance gap.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest security-process gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. For a library with authentication, database, and cryptographic-related dependencies, this weakens vulnerability-reporting transparency.

Token permissionscaution

The sole workflow does not declare top-level token permissions. Although no write permissions were detected, explicit least-privilege settings would provide stronger CI hardening.