illuminate/hashing

Dangerous workflowscaution

One workflow uses pull_request_target, which can expose privileged automation to pull-request events; no untrusted checkout or script injection was detected, limiting the concern.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. The recent push and ongoing release history partly offset this, but the current development activity is still a meaningful maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a transparency and assurance gap, though it is not by itself evidence that the package is unsafe.

Token permissionscaution

The sole workflow has no top-level token permissions declaration. It does not request explicit top-level write access, but the missing restriction leaves permissions less transparent than they should be.