innmind/framework

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign that current maintenance may have slowed despite the broader release history.

Repo popularitycaution

Five stars and no forks show a small user and contributor footprint. Popularity is only supporting evidence, but this limited external base provides little resilience if the primary maintainer stops work.

Repo toolingcaution

The project uses Make and Composer, but no security-scanning tooling was detected. This is a modest transparency and maintenance gap, not evidence that the release is unsafe.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations for a framework package.

Workflow auditcaution

All six analyzed action references are unpinned, which weakens build reproducibility, and all three workflows have high-confidence secrets-inherit findings; one workflow also grants top-level write permissions. No dangerous trigger or untrusted checkout sink was found, so this is workflow hygiene risk rather than a severe standalone issue.