maxsky/swoft-app-key-generator

Licensecaution

The package declares Apache-2.0, while the artifact license file is detected as MIT. Although a license file exists, the mismatch creates avoidable legal ambiguity.

Release historycaution

This is the only release, published nearly seven years ago, with no releases in the last 12 months. That long period without versioned maintenance raises abandonment risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the nearly seven-year release gap and little evidence of ongoing maintenance.

Repo toolingcaution

Composer is used for the build, which is appropriate, but no security-scanning tooling is reported. That weakens supply-chain maintenance evidence without making the release unfit on its own.

Security policycaution

The linked repository has no security policy, leaving no stated process for reporting or handling vulnerabilities. This is a transparency gap for a package that modifies application configuration.