ernestdefoe/federation
ActivityPub federation for Flarum 2 — make your community a discoverable, followable fediverse actor. People on Mastodon, Lemmy and other servers can follow @{community}@{host} (and individual members) and receive every new discussion in their timeline. Inbound replies and likes flow back in as posts and reactions. No core files touched.
80%
Total Score
healthy
Active project with a security-focused release, but its GitHub Actions references are unpinned.
Health Score Breakdown
Composer build tooling is present, but no security-scanning tool was detected, leaving less automated assurance for a security-sensitive integration.
The repository has no SECURITY.md or other declared security policy, which is a transparency gap for an extension that processes remote ActivityPub input.
All four workflows were analyzed with no untrusted checkouts or script-injection findings, but both analyzed action references are unpinned and two workflows grant top-level write permissions, creating workflow hygiene risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 ernestdefoe |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 flarum/core Version ^2.0 | — | — |
guzzlehttp/guzzle Version ^7.0 | — | — |
Weekly Downloads
Info
- Last Published
- 4 days ago
- Created
- 3 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.