maizied/roast-api

The project has a clear README, release notes for this version, a stable version, and a small runtime dependency surface. It lacks a security policy, and its three releases were published within minutes rather than showing an established release cadence.

Latest v1.5.0

Packagist

64%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

All three releases occurred within a few minutes on the first release day, leaving little evidence of an established release cadence despite the package being about 212 days old.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. That quiet period raises maintenance and abandonment concerns, although the repository was pushed more recently than the release history suggests.

Repo tooling

Composer is used as a build tool, but no security scanning tooling was detected. For a small client this is a transparency gap rather than a severe adoption blocker.

Security policy

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities.

Workflow audit

The sole workflow gives every workflow a top-level write token and leaves all 10 action references unpinned. The only audit finding is low-confidence cache-poisoning, so it is hygiene rather than a severe workflow risk.