cleaniquecoders/php-env-key-manager

Release historycaution

Only two releases exist, with none in the last 12 months; this indicates slow maintenance, although the repository remains active enough to provide some supporting evidence.

Repo commit activitycaution

There were no commits from active maintainers in the last three months, a concrete sign of currently limited development activity.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap, though not severe for the score.

Workflow auditcaution

The audit found a high-confidence bot-condition issue and all 9 of 9 action references are unpinned; three workflows also grant top-level write access. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are hygiene concerns rather than a severe standalone risk.