johannschopplich/kirbylog

Project backingcaution

The package and repository are owned by the same individual account. A single-person project is plausible here, but it offers less organizational continuity than backed projects.

Release historycaution

The package has 22 releases since August 2021, but none in the last three years; the latest registry release was in November 2023. This is a meaningful maintenance concern, although the repository was pushed in April 2025.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. That is a modest transparency and hygiene gap, not evidence of abandonment by itself.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap for a maintained package, but not a severe adoption blocker alone.

Workflow auditcaution

The sole workflow gives every job top-level write permissions and all three action references are unpinned. The audit also found a low-confidence cache-poisoning pattern; because it is low confidence and no untrusted trigger or checkout was found, this remains workflow hygiene rather than a severe risk.