instapage/php-logger

Licensecaution

The manifest declares a proprietary license, with no detected license text in the package or repository. That creates a material adoption and redistribution concern for an open-source dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured before collection, indicating a thin or recently stalled maintenance stream. The recent release partly offsets this, but does not remove the concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a logging library, this is a transparency and maintenance gap rather than evidence of a defect.

Security policycaution

The repository has no security policy. That leaves vulnerability reporting and response expectations unclear for a dependency used in application infrastructure.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no dangerous audit findings. However, all four action references are unpinned, leaving build inputs less reproducible and increasing workflow supply-chain exposure.