hyperf/json-rpc

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase workflow risk when handling untrusted pull requests, although no untrusted checkout or script injection was detected.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. This is concerning despite the recent release and established release history because current development activity is not visible.

Repo issue activitycaution

Only one issue is open and there are no open pull requests, but there was no issue or pull-request movement during the last month, providing little evidence of active maintenance through community activity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured, leaving a preventable gap in repository hygiene.

Token permissionscaution

Both analyzed workflows omit top-level GitHub Actions permissions declarations. No workflow requests top-level write access, but explicit least-privilege settings would provide stronger protection.