clarkeash/php-jwk

Release historycaution

The package is only 103 days old, with all 9 releases published on the same day; this shows active initial publishing but provides little evidence of sustained maintenance.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. For a package only 103 days old, this is a meaningful warning about maintenance continuity.

Repo toolingcaution

The project uses Make and Composer, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence of abandonment.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations unclear for a cryptographic key-handling library.

Workflow auditcaution

Both workflows were analyzed without high- or medium-severity findings and no untrusted checkout or script-injection paths were detected. However, all 14 action references are unpinned, and one workflow grants top-level write access, weakening build reproducibility and workflow hygiene.