calliostro/spotify-bundle

Release historycaution

This is the first release, published today, so there is no track record for maintenance or compatibility. Its newness is a meaningful uncertainty rather than evidence of abandonment.

Repo commit activitycaution

There were no commits in the past three months and no active maintainers in that period. Because the repository is only one day old, this mainly means maintenance capacity is not yet demonstrated.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for consumers of an integration that handles API credentials.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkout or script-injection trigger, so the low-confidence cache findings are hygiene only. However, all 10 action references are unpinned, weakening CI supply-chain reproducibility.