hasura-extra/bundle

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release partly offsets this, but the current lack of observed development is a maintenance concern.

Repo popularitycaution

One star and one fork show a very small user and contributor audience. Popularity is only supporting evidence, but this limits external validation and resilience if the main maintainers stop working.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest assurance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no published security policy, leaving no documented process for reporting and handling vulnerabilities.

Workflow auditcaution

The single workflow uses a pull_request_target trigger without an untrusted checkout or script-injection sink, so that trigger is not dangerous on its own. However, its one action reference is unpinned, which weakens build reproducibility and supply-chain hygiene.