contenir/contenir-mail

Release historycaution

The package is only 1 day old with four releases, arriving roughly every 8 hours. That shows active initial publishing but provides little long-term maintenance history.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last 3 months, a serious maintenance signal for a package that is only 1 day old. Recent repository push and merge activity soften but do not remove the concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The repository's SECURITY.md provides some compensating process documentation, so this is a limited hygiene concern.

Version stabilitycaution

Version 0.3.0 is not a prerelease, but it is still below a stable major version. The absence of recent prereleases is mildly reassuring, not evidence of maturity.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts or script injection, and one uses read-only permissions. However, all four actions are unpinned and two high-confidence medium-severity findings expose inherited secrets to reusable workflows.