mervick/aes-bridge

The repository has no security policy and all three workflow actions are unpinned, leaving avoidable maintenance and build-integrity gaps. MIT licensing, tests, documentation, and a small dependency surface provide useful compensating evidence.

Latest v2.0.1

Packagist

55%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only two releases were published, both within roughly one hour, and there have been no releases in about 14 months. This indicates a young project with no recent registry maintenance.

Repo commit activity

There were no commits and no active maintainers in the last three months, while the last repository push was about 14 months ago. This is meaningful evidence of slowed maintenance.

Repo tooling

Composer is used for the build, but no security scanning tools are configured. That leaves a modest transparency and maintenance gap for a cryptography-related package.

Security policy

The repository has no security policy. For an encryption library, the absence of a documented vulnerability-reporting process is a real transparency gap.

Workflow audit

Both workflows were analyzed successfully with no dangerous triggers, sinks, or audit findings, but all three action references are unpinned. Pinning them would reduce avoidable build-integrity risk.