marcin-orlowski/php-lockpick

Registry deprecationdanger

Packagist marks the package abandoned at package scope, with no distinct replacement identified; this is a serious adoption and maintenance warning despite other healthy project evidence.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured, indicating limited recent development activity despite the latest release.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so there is no documented channel or process for handling vulnerability reports.

Workflow auditcaution

All four workflows were analyzed without trigger or injection findings, but all nine action references are unpinned; this is a supply-chain hygiene weakness rather than a severe workflow risk.