jamosaur/foundation

Maintainerscaution

Only one account has registry publish access. That is a limited publishing base for a user-owned project and increases continuity risk if the maintainer becomes unavailable.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although releases occurred within the last year, the short-term lack of development activity is a maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap, not evidence that the package is unsafe.

Security policycaution

No repository security policy was found, leaving reporting and response expectations undocumented for a framework integration package.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all three referenced actions are unpinned, which weakens build reproducibility and supply-chain hygiene.