kynetcode/wpzylos-security

Release historycaution

This is a young package, about 97 days old, with two releases and a median interval of about 41 days. That provides some release evidence but leaves limited history for judging long-term maintenance.

Repo bus factorcaution

All three commits in the last three months came from one contributor, giving the project a single-person maintenance dependency. The repository owner is an individual account, so no organizational handoff evidence offsets that concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. For a package providing security primitives, that is a meaningful maintenance and assurance gap.

Workflow auditcaution

All 9 analyzed action references are unpinned, so workflow dependencies can change without a repository change; one workflow also grants top-level write access. The audit found no untrusted checkout, script injection, or high-confidence dangerous workflow finding.