ianm/url-cron

Project backingcaution

The repository is owned by an individual rather than an organization, so the small maintainer base is not backed by an explicitly identified organizational handoff structure. Recent activity and balanced contributions compensate for much of that risk.

Release historycaution

The package has only three releases across about 3 years and 4 months, with a typical gap of roughly 20 months. A release in the last several weeks and recent repository activity partly offset the slow cadence, but it remains a maintenance caution.

Repo toolingcaution

The project uses Composer build tooling, but no security scanning tools were detected. The missing scanning is a modest transparency and maintenance gap, not evidence of unsafe code by itself.

Security policycaution

The repository has no security policy. For a package exposing a scheduler-triggering endpoint, this reduces transparency for reporting security issues, though it does not indicate abandonment.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, both of the two action references are unpinned, leaving a small build-reproducibility and supply-chain hygiene gap.