farzai/kapi-sdk

Workflow auditdanger

All 12 action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; three workflows also grant top-level write permissions. The pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the severity but leaving significant automation hygiene risk.

Release historycaution

There has been only one registry release, on May 22, 2023, with no releases in the following 12 months. That weak release history raises abandonment and update-confidence concerns, although the repository is not archived.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent push timestamp is some compensating evidence, but it does not establish sustained maintenance.

Security policycaution

The repository has no security policy. This is a transparency gap for an SDK handling authentication and payment-related APIs, though it does not by itself show abandonment.

Version stabilitycaution

Version 0.0.1 is an early, non-stable-major release, so its API and implementation may still change substantially. The absence of a prerelease label does not compensate for the very early version.