imbo/imbo-coding-standard

Repo commit activitycaution

The repository reports zero commits and zero active maintainers in the last three months, a maintenance warning. The recent release history and same-day push partly offset this concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. For a small coding-standard package this is a modest transparency and maintenance gap.

Security policycaution

The linked repository has no security policy. This limits vulnerability-reporting transparency, though it does not by itself indicate abandonment.

Workflow auditcaution

All three workflows were analyzed, but one has a script-injection finding and top-level write permissions, while high-confidence findings report GitHub App tokens with blanket repository access and template-injection risks. The absence of untrusted checkouts reduces the likelihood of immediate exploitation, but the automation remains a meaningful supply-chain hygiene concern.