codeigniter4/appstarter

Healthy and suitable to use, with a few repository-security caveats. It has a long, steady release history, an active organizational owner, tests, release notes, and a matching source repository, but no commits in the last three months and a workflow with write access and pull-request targeting deserve review.

Latest v4.7.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One of two analyzed workflows uses pull_request_target, which warrants review because it can run with elevated repository context even though no untrusted checkout or script injection was detected.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful recent-maintenance gap despite the recent release and push evidence.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a repository security-hygiene gap.

Token permissions

Both workflows declare permissions, but one has top-level write access while the other is read-only; the write-capable workflow increases the potential impact of a workflow compromise.