marcin-orlowski/lockpick

The small project has no recent commit activity and no documented security policy, while all nine workflow actions are unpinned. It remains transparent and maintained enough to consider, with tests, release notes, a license, and a recent stable release.

Latest 1.5.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

There were 0 commits and 0 active maintainers in the last 3 months. This is a meaningful maintenance concern, although the package had a release on February 1, 2026.

Repo popularity

The repository has 1 star, 0 forks, and 1 watcher, indicating very limited external adoption or review. Popularity is supporting evidence, so this lowers confidence in community resilience rather than proving the package is unsafe.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning layer is a modest transparency and maintenance gap for a dependency.

Security policy

The repository has no security policy. That leaves vulnerability reporting and response expectations undocumented, which is a real transparency gap for a library dependency.

Workflow audit

All 4 workflows were analyzed successfully with no dangerous audit findings or untrusted checkouts, but all 9 action references are unpinned. The workflows also lack top-level permission blocks; this is acceptable on its own, while unpinned actions remain a supply-chain hygiene concern.