kenzal/log-to-dump

Lifecycle scriptscaution

A post-autoload-dump script runs during installation. Such Composer hooks can be legitimate, but they add execution-time complexity compared with a package without lifecycle scripts.

Release historycaution

This is the only release, published about 14 months ago, with no releases in the last 12 months. That limits evidence of ongoing maintenance, though a small stable package may not need frequent releases.

Repo commit activitycaution

The repository has had no commits or active maintainers in the last three months, consistent with a project that has not changed since its initial release. The package is small, but this still raises abandonment risk.

Security policycaution

The linked repository has no published security policy. This is a transparency gap for reporting vulnerabilities, although it does not by itself show that the package is unsafe.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no reported audit findings or untrusted execution sinks. However, both action references are unpinned, leaving the workflow exposed to upstream reference changes.