mettle/sendportal-core

Repo commit activitycaution

The repository records zero commits and zero active maintainers over the last 3 months. Recent pull-request merges and today's release provide some compensation, but the direct commit inactivity is a maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning layer is a modest supply-chain hygiene gap, not evidence of abandonment.

Security policycaution

The repository has no security policy. That reduces transparency for reporting vulnerabilities, although it does not by itself indicate unsafe code.

Workflow auditcaution

Both workflows were analyzed completely and have no untrusted checkout or script-injection findings, but all 3 action references are unpinned and the audit found a high-confidence, high-severity unpinned container image. This creates avoidable build-provenance risk.