nowo-tech/altcha-type-bundle

Workflow auditdanger

All seven workflows were analyzed, but both high-confidence template-injection findings involve workflows with attacker-reachable automation, including an untrusted checkout in coderabbit.yml; all 22 action references are also unpinned. These create meaningful release and CI integrity risk.

Dependency profilecaution

The bundle declares 22 runtime dependencies, largely matching its Symfony integration scope, but the relatively broad dependency surface increases upgrade and compatibility exposure.

Release historycaution

There are three releases in less than a day, showing active initial publishing but providing too little history to establish long-term maintenance reliability.

Repo commit activitycaution

The repository reports zero commits and zero active maintainers in the last three months, but the package itself is less than a day old, so this mainly limits maturity evidence rather than proving abandonment.