humanmade/dev-tools

Registry deprecationdanger

Packagist marks the package as abandoned and identifies altis/dev-tools as a replacement. This is a severe adoption risk even though the assessed release is recent.

Dangerous workflowscaution

One workflow uses pull_request_target, which can expose privileged workflow behavior to pull-request handling. No untrusted checkouts or script-injection patterns were found, partly compensating for the concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response guidance unclear. This is a transparency gap, although it does not by itself indicate abandonment.

Token permissionscaution

Five of six workflows lack top-level token permissions, and one workflow has write permissions. The broad or unspecified permissions increase CI configuration risk and reduce security hygiene.