dedoc/scramble
A clear README, release notes, and MIT license make adoption straightforward. The missing security policy and concentrated commit ownership deserve monitoring, while the workflow audit found no dangerous patterns.
86%
Total Score
88
94
67
Health Score Breakdown
One contributor made about 84% of the last three months' commits. The 11 contributors and organization-owned project partly compensate, but responsibility remains concentrated.
Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency gap rather than evidence of unsafe code.
The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.
All three workflows were analyzed with no dangerous audit findings or untrusted checkouts. However, five of eight action references are unpinned and one workflow grants top-level write access, creating moderate hygiene risk.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-44262 dedoc/scramble is vulnerable to Improper Control of Generation of Code ('Code Injection') in versions 0.13.2 - 0.13.21. | 0.13.2 - 0.13.21 | Critical |
Package versions
Maintainers
 Roman Lytvynenko |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 nikic/php-parser Version ^5.0 | — | — |
myclabs/deep-copy Version ^1.12 | — | — |
illuminate/contracts Version ^10.0|^11.0|^12.0|^13.0 | — | — |
phpstan/phpdoc-parser Version ^1.0|^2.0 | — | — |
spatie/laravel-package-tools Version ^1.9.2 | — | — |
Weekly Downloads
Info
- Last Published
- 2 days ago
- Created
- 4 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.