davidhirtz/yii2-skeleton

Licensedanger

The manifest declares a proprietary license, with no detected license text or license file in the package or repository. That creates a meaningful adoption and redistribution concern for an open-source dependency.

Repo bus factorcaution

Two contributors were active in the last three months, but the leading contributor made about 95% of commits. The second contributor provides some continuity, but maintenance remains highly concentrated.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools were detected. This is a modest gap in automated security hygiene rather than evidence of abandonment.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting and coordinating security issues, although the active development signals partly offset its practical impact.

Workflow auditcaution

Both workflows were analyzed successfully and have no dangerous triggers or audit findings, but all 4 action references are unpinned. This weakens build reproducibility and leaves action versions less controlled.