isaeken/envman

Release historydanger

Only one release exists, published nearly four years ago, with no releases in the last 12 months. This leaves compatibility and maintenance uncertain for a Laravel dependency.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with a project that has received little recent attention.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a secondary concern because the package is small and otherwise has visible source and licensing.

Workflow auditcaution

All 6 analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, which limits the severity.