cego/durable-workflow

Lifecycle scriptscaution

A post-autoload-dump install lifecycle script can run package code during installation, creating some supply-chain exposure, although this signal does not show harmful behavior.

Release historycaution

This registry release is the package's first recorded release and is only 0 days old, so there is no registry history to establish long-term stability. Recent repository activity partly offsets that uncertainty.

Repo bus factorcaution

Three contributors were active in the last three months, but one contributor made about 71% of the 14 commits. The organization backing provides some handoff capacity, limiting this to a mild concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving automated vulnerability checks less visible.

Security policycaution

The repository has no published security policy, reducing transparency about how users should report and receive fixes for vulnerabilities.