idct/php-csv-writer

Release historycaution

The latest release was more than six years ago, with no releases in the last 12 months. That is strong evidence of inactivity, although the package is small and the current version is stable.

Security policycaution

The repository has no security policy. For a small library this is a modest transparency gap, but it leaves no documented channel or process for security reports.

Workflow auditcaution

The single workflow has two high-confidence template-injection findings and both action references are unpinned. No dangerous trigger or untrusted checkout was reported, so this is a hygiene and reproducibility concern rather than a standalone critical risk.