firehed/security

The repository has tests, release notes, a clear license, and a small runtime dependency footprint. Its latest release was about five years ago, recent commit activity is absent, and all workflow actions are unpinned.

Latest 1.1.0

Packagist

63%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The package and repository are owned by the same individual account, so the ownership context is consistent. It does not provide the resilience of an organization-backed maintainer base.

Release history

The latest registry release was about five years ago, with no releases in the last 12 months. That is a meaningful maintenance concern for a security-focused library, despite seven total releases and a long project history.

Repo commit activity

There were no commits and no active maintainers in the three months measured. This is direct evidence of currently inactive development and raises the risk that defects or compatibility issues will remain unaddressed.

Security policy

The repository has no security policy. For a package explicitly providing security tools, that is a transparency and vulnerability-reporting gap.

Workflow audit

All three workflows were analyzed successfully and no dangerous audit findings were reported, with no untrusted checkouts or script injection detected. However, all 10 action references are unpinned, leaving workflow dependencies exposed to mutable upstream changes.