google/recaptcha

The package is well documented, has a small runtime dependency surface, and includes a security policy plus read-only workflow permissions. All three workflow actions are unpinned, and no repository security scanning is reported.

Latest 1.5

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Repo commit activity

There were no commits or active maintainers in the three months measured, which suggests a recent slowdown. However, the repository was pushed after the latest release and the registry shows four releases in the past year, so this is a limited caution rather than abandonment evidence.

Repo tooling

Composer build tooling is present, but no security scanning tools are reported. This is a modest transparency and maintenance gap, not evidence that the package is unsafe.

Workflow audit

The single workflow was fully analyzed, uses read-only permissions, and has no reported audit findings or untrusted execution sinks. However, all 3 of 3 action references are unpinned, leaving avoidable reproducibility and action-substitution risk.