darkwebdesign/symfony-addon-transformers

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Although the recent release is compensating evidence, the lack of recent development lowers confidence in ongoing maintenance.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For a small PHP library this is a transparency and maintenance weakness rather than a severe risk.

Security policycaution

The repository has no SECURITY.md or other security policy. That leaves vulnerability reporting and response expectations unclear.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but all 18 action references are unpinned. The absence of a top-level permissions block is acceptable on its own, while unpinned actions remain a supply-chain hygiene concern.