ekvedaras/dcb-eventstore-illuminate

Maintainerscaution

Only one registry account has publishing access. The repository is also owned by the same individual, so this is a genuine bus-factor concern rather than ordinary organization publishing hygiene.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. The recent release history partly offsets this, but the current lack of observed development activity is a maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest hygiene gap for a package with runtime dependencies.

Security policycaution

The linked repository has no security policy. That weakens vulnerability-reporting transparency, although it does not by itself indicate abandonment.

Workflow auditcaution

The workflow audit completed fully and found read-only permissions with no untrusted checkout or script-injection paths. However, all three analyzed action references are unpinned and the high-confidence audit found floating latest container images, creating avoidable build reproducibility and supply-chain hygiene risk.