laratusk/spreedly

Repo bus factorcaution

One contributor made all three commits in the last three months, concentrating recent maintenance in a single person. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

The repository received three commits in the last three months, so activity has not stopped. However, the volume is modest for a young SDK and contributes some maintenance uncertainty.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a payment API SDK, that missing security automation is a meaningful hygiene gap.

Security policycaution

The repository has no security policy. That reduces transparency about how consumers should report vulnerabilities, although it is not evidence that the package is unsafe by itself.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all four referenced actions are unpinned, leaving workflow dependencies less reproducible and increasing supply-chain exposure.