heyosseus/phpstan-sloppy

Maintainerscaution

One registry maintainer is a limited publishing base for a new package, leaving less visible redundancy if that account becomes inactive.

Release historycaution

The package is less than one day old and has only two releases, so long-term maintenance and stability cannot yet be demonstrated.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no published security policy, reducing transparency about how vulnerability reports are handled.

Workflow auditcaution

The workflow was fully analyzed and uses read-only permissions with no detected audit findings, but all three action references are unpinned, weakening build reproducibility and update integrity.