gghughunishvili/entrust

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, despite the fresh release and recent merged pull requests. That inconsistency weakens confidence in sustained development activity.

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tooling was detected. The missing scanning is a modest transparency and assurance gap, not evidence of unsafe code.

Security policycaution

The repository has no security policy. For a permissions and middleware package, the missing disclosure and response guidance is a genuine but moderate maintenance gap.

Workflow auditcaution

The workflow was fully analyzed and uses read-only permissions with no untrusted checkouts or injection findings. However, all three referenced actions are unpinned, leaving avoidable supply-chain exposure.