erwane/whep

Release historycaution

The package is only 84 days old, with all 17 releases published on the same day and a median release interval of 0 days. This shows active initial work but does not yet demonstrate sustained maintenance.

Repo bus factorcaution

All 16 commits in the last 3 months came from one contributor, leaving maintenance dependent on a single person. The repository is user-owned rather than organization-backed, so there is no shown handoff capacity to offset that concentration.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and assurance gap rather than a severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This lowers transparency for a library handling provider webhooks.

Workflow auditcaution

The workflow uses read-only permissions and has no untrusted checkouts or script-injection findings, but all 6 of 6 action references are unpinned. The audit completed successfully, yet unpinned actions weaken build reproducibility and update safety.