horde/nag

Dependency profilecaution

The package declares 29 runtime dependencies and no development dependencies, reflecting a substantial framework integration surface. This adds dependency-management complexity, but the long history and active release cadence provide compensating maturity evidence.

Repo popularitycaution

The repository has only 2 stars and 7 forks, indicating limited public popularity. Popularity is supporting evidence rather than a health verdict, and the active release and commit history compensates for this.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tools were detected. The missing scanning is a modest transparency gap, while other workflow checks provide some compensating engineering structure.

Security policycaution

No repository security policy was found. This is a genuine disclosure-process gap, although it does not outweigh the package's active maintenance and transparent source repository.

Token permissionscaution

The single workflow does not declare top-level token permissions. No top-level write permissions were observed, but explicit least-privilege settings would provide stronger workflow transparency.