nimbly/proof

It includes a clear README, tests, release notes, matching source repository, and a stable MIT license. The small project has no recent release or commit activity, lacks a security policy and scanning, and uses three unpinned workflow actions.

Latest 2.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has seven releases since August 2020, but none in the last 12 months; the latest release was over a year ago. This indicates slowed maintenance, though the repository was pushed more recently.

Repo commit activity

There were no commits and no active maintainers in the last three months, which weakens evidence of ongoing maintenance. The recent release and repository push provide some compensating evidence but do not show current development.

Repo tooling

The project uses Composer and Make, showing basic build structure, but it has no detected security scanning. For a JWT library, that missing security practice is a meaningful transparency gap.

Security policy

The repository has no security policy. For a library handling signed tokens and claims, the absence of documented vulnerability reporting lowers transparency.

Workflow audit

All workflows were analyzed and one workflow uses read-only permissions with no dangerous triggers or audit findings. However, all three analyzed actions are unpinned, leaving avoidable build-integrity exposure.