Healthy and actively maintained, with sensible caveats. It has regular releases, current repository activity, tests, and organizational backing, but all recent commits come from one contributor and the repository lacks a security policy and explicit workflow permissions.
78%
Total Score
90
94
80
One contributor made all 31 commits in the last 3 months, creating a genuine continuity risk; organizational ownership provides some capacity to hand maintenance off.
Composer build tooling is used, but no security scanning tools were detected; this limits automated security-quality coverage without making the package unfit to use.
No repository security policy was found, reducing transparency around vulnerability reporting and response expectations.
The only workflow lacks top-level token permissions, so its GitHub Actions access is not explicitly constrained to read-only or minimal permissions.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
leafs/db Version ^5.1 | — | — |
leafs/leaf Version ^5.0 | — | — |
leafs/sprout Version ^5.1 | — | — |
symfony/yaml Version * | — | — |
vlucas/phpdotenv Version * | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.