hyperf-plus/validate

Licensecaution

The artifact declares Apache-2.0 but its LICENSE file is detected as MIT, creating a material licensing ambiguity despite license files being present in both the artifact and repository.

Repo commit activitycaution

The repository recorded no commits and no active maintainers during the last three months, which weakens evidence of ongoing maintenance despite the recent release history.

Repo toolingcaution

The project uses Composer build tooling, but no security scanning tools were detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerability reports are handled.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, injection findings, or excessive permissions. However, all three action references are unpinned, so their versions are not reproducibly fixed.