endroid/qr-code-bundle

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, although the recent registry releases and recent repository push provide some compensating evidence.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The workflow audit completed cleanly with no dangerous triggers, untrusted checkouts, or findings, but all 5 action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own but provides less explicit restriction.