moov/moov-php

Licensecaution

The manifest declares MIT, but the artifact license file is recognized as Apache-2.0, creating a material licensing ambiguity despite both the artifact and repository containing license files.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning tooling is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Version stabilitycaution

This release is a beta prerelease, although prereleases make up only 15% of recent releases and the major line is stable. The beta label adds some adoption risk for consumers seeking a settled API.

Workflow auditcaution

Both workflows grant top-level write permissions and all 2 analyzed action references are unpinned. No untrusted checkout, script injection, or audit findings were detected, so this is workflow hygiene risk rather than a severe exposure.