innmind/log-reader

Workflow credentials are broader than needed and all five actions are unpinned. The project still has a recent release, documentation, tests, and an unarchived organizational repository.

Latest 6.0.0

Packagist

68%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed since 2017, but only one release appeared in the last 12 months and releases are typically about 237 days apart. The latest release is recent, so this indicates a slow rather than abandoned cadence.

Repo commit activity

There were no commits and no active maintainers in the last three months. This is a meaningful maintenance concern, although the recent release and unarchived repository provide some counterevidence.

Repo tooling

The repository uses Composer build tooling, but no security scanning tools were detected. The missing scanning is a modest transparency and maintenance gap.

Security policy

The repository has no security policy. That makes vulnerability reporting less clear for a package intended for dependency use.

Workflow audit

All five analyzed action references are unpinned, and both workflows inherit secrets with high-confidence medium-severity findings. The audit was complete and found no untrusted checkouts or script injection, limiting this to a workflow-hygiene concern.