herald-si/verificac19-sdk-php

Release historycaution

The package has 30 releases and a short historical median interval, but it has had no releases in the last 12 months and its latest release was in January 2023. This is a meaningful maintenance concern.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Together with the last push in January 2023, this indicates prolonged inactivity and raises abandonment risk.

Repo toolingcaution

Composer is used for builds, but no security scanning tools are present. For a package handling certificate data and cryptographic verification, that is a real maintenance-hygiene gap.

Security policycaution

The repository has no security policy. This reduces transparency around vulnerability reporting, though it is less serious than evidence of unsafe code or abandoned releases.

Workflow auditcaution

All five workflows were analyzed successfully and have no untrusted checkouts, injection findings, or write permissions, but all 15 action references are unpinned. That leaves avoidable workflow supply-chain exposure.