divineomega/password_exposed

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no distinct replacement identified, which is a serious adoption and continuity concern. Recent releases do not remove the registry's explicit abandonment status.

Repo bus factorcaution

Two contributors were active in the last 3 months, with the leading contributor responsible for about two-thirds of commits. The second active contributor reduces single-person dependence, though the contributor base remains small.

Security policycaution

The repository has no security policy. For a package that checks passwords through an external breach-status service, the missing reporting and response guidance is a transparency gap.

Workflow auditcaution

Both workflows were analyzed without detected injection or other audit findings, but all 8 action references are unpinned. The lack of a top-level permissions block is acceptable here, while unpinned actions remain a supply-chain hygiene concern.