illuminate/pipeline

Dangerous workflowscaution

One workflow uses pull_request_target, which can expose elevated repository context when handling untrusted pull requests. No untrusted checkout or script injection was detected, limiting the concern to workflow design risk.

Package scaffoldingcaution

The published artifact has no README, tests, or changelog, and the repository also reports no tests or changelog. The missing README is a real consumer-documentation gap for a library, although the very small package tree reduces the maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, which is a maintenance warning. Four releases in the last year and a push about 2 days ago provide some compensating evidence, so this is caution rather than danger.

Repo toolingcaution

Composer is used for builds, but no security scanning tools are configured. The missing scanning lowers transparency around dependency and build hygiene, though it does not by itself make the package unfit.

Security policycaution

The repository has no security policy. This makes vulnerability reporting and response expectations less transparent, although the absence is not evidence of a vulnerability.