hexydec/cssdoc

Maintainerscaution

Only one registry account has publish access. The linked repository is user-owned rather than organization-owned, so the thin publishing base leaves limited visible redundancy.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This is a maintenance concern, although the recent release and repository push provide some compensating evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported. The missing scanning is a hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, though it does not by itself show that maintenance has stopped.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings. However, all four action references are unpinned, leaving the workflow exposed to dependency drift.