leafs/cors

Release historycaution

The package has existed for about 5 years but has only 5 releases, with a median interval of about 16 months; one release in the last year shows ongoing but infrequent maintenance.

Repo bus factorcaution

All 5 recent commits came from one contributor. The organization backing helps provide handoff capacity, but no second active contributor is shown, leaving a real concentration risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest verification gap for a package intended to handle web requests.

Security policycaution

The repository has no security policy. This is a transparency and disclosure-process gap, though it is not severe enough to make the release unfit by itself.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, sinks, or audit findings, but all 4 action references are unpinned, weakening build reproducibility and supply-chain hygiene.