illuminate/reflection

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months, a maintenance concern that is partly offset by the package's frequent release history and current push timestamp.

Repo toolingcaution

Composer is used as the build tool, but no security scanning tools were detected; this is a modest transparency and hygiene gap.

Workflow auditcaution

The single workflow had no dangerous audit findings and no broad top-level write permission, but its one action use is unpinned. The pull_request_target trigger is not concerning here because no untrusted checkout or script-injection sink was found.