horde/pgp

Release historycaution

Only two releases have appeared over about 2 years and 9 months, with one release in the last 12 months and a median gap of about 2 years and 6 months. This indicates a slow maintenance cadence.

Repo bus factorcaution

All 3 recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown to reduce the immediate concentration risk.

Repo commit activitycaution

The repository had 3 commits in the last 3 months, showing some ongoing activity, but the volume is modest for a dependency with a long release interval.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest transparency and maintenance gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, which leaves vulnerability reporting and response expectations undocumented for a security-sensitive PGP library.