machour/clictopay

Release historycaution

The package has only 2 releases across about 4 years, with a median interval of about 3 years and 2 months. One release in the last 12 months shows some recent activity, but the overall cadence is thin.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. The recent release provides some counterevidence, but current maintenance activity is still limited.

Repo toolingcaution

Composer is used for the build, but no security scanning tools are configured. This is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no high-confidence audit findings or unsafe triggers, but all 4 action references are unpinned. Unpinned actions weaken build reproducibility and supply-chain hygiene.