kusikusicms/models

Release historycaution

This is the first release, published less than a day ago, so there is no release cadence or track record yet. That is an evidence gap for maturity rather than proof of abandonment.

Repo commit activitycaution

No commits and no active maintainers were observed in the last three months, but the repository and release are less than a day old. This limits evidence of maintenance capacity without showing a long-term collapse.

Repo toolingcaution

Composer is used for the build, but no security scanning tool was detected. The missing scanner is a hygiene gap, not a standalone reason to reject the release.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, though it is a secondary concern for this newly published package.

Workflow auditcaution

The sole workflow uses a pull_request_target trigger with no untrusted checkout or script-injection sink, so that trigger is not dangerous here. However, it has top-level write permissions and its single action use is unpinned, creating mild workflow hygiene concerns.