netherphp/surface

Licensecaution

The manifest declares BSD-3-Clause, while the artifact license file was detected as BSD-2-Clause. A license is present, but the mismatch creates avoidable uncertainty about the intended terms.

Release historycaution

The latest release was published in March 2022, with no releases in the past 12 months. The repository was pushed in October 2025, which suggests some project activity but does not show current release maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the past 3 months. This reinforces the concern about the absence of recent registry releases, although the repository had a later push in October 2025.

Security policycaution

The repository has no SECURITY.md or other declared security policy. This is a transparency and response-process gap, though it is not evidence of a vulnerability.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but all 3 action references are unpinned. The missing top-level permissions block is acceptable on its own and no write-wide token was observed.