ingenerator/tokenista

Release historycaution

The package is long-established, but it had no releases in the last 12 months and its median release interval is about 343 days, indicating a slow release cadence.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, which is a meaningful sign of currently quiet maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; for a library handling signed tokens, that leaves a modest transparency gap.

Security policycaution

The repository has no security policy, making the process for reporting and handling vulnerabilities unclear for a security-sensitive token library.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all three action references are unpinned, so their fetched code is not fixed to reviewed revisions.