contenir/contenir-diagnostics

Release historycaution

This is the package's first release, published 0 days ago, so there is no release track record yet. That is a meaningful maturity gap, though the release notes document the initial scope and changes.

Repo commit activitycaution

The repository shows 0 commits and 0 active maintainers in the last 3 months, which limits evidence of sustained maintenance. Recent repository activity and three merged pull requests provide some immediate backing but not a long-term record.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. This is a modest transparency and maintenance gap rather than a severe concern for a first release.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. The package's documented security-advisory check is useful for consumers but does not replace a project policy.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script injection, but all 1 action reference is unpinned and a high-confidence medium-severity secrets-inherit finding gives a workflow broader credentials than needed.