horde/compress

Repo bus factorcaution

Only one contributor made all three commits in the last 3 months, giving the project a concentrated recent maintenance base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Three commits were made in the last 3 months, indicating recent but limited maintenance activity. The low volume warrants some caution for a core library dependency.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest repository hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy. This reduces transparency about vulnerability reporting and response expectations, although it is not a direct indication that the package is unsafe.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings; one workflow scopes permissions at job level. However, 6 of 7 action references are unpinned, leaving avoidable build reproducibility and dependency-integrity risk.