illuma-law/healthcheck-pgvector

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers during the last three months, which is a meaningful maintenance concern for a package this young.

Workflow auditdanger

All 12 analyzed action uses are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-condition issue; the pull_request_target workflow has no reported untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe standalone threat.

Lifecycle scriptscaution

A post-autoload-dump install-time script is present. This is not automatically unsafe, but it adds execution behavior that consumers should understand.

Release historycaution

The package is only 154 days old and has four releases, all clustered within about one week. That shows initial activity but provides limited evidence of long-term maintenance.

Security policycaution

The repository has no security policy. This is a transparency gap, though it is less significant for a small focused integration package than for security-sensitive software.