oliezekat/smart-youtube-api-client

Release historycaution

The package is only 26 days old, with three releases and a median interval of about 3 days. That shows active initial development but leaves limited evidence of long-term maturity.

Repo bus factorcaution

One contributor made all 17 commits in the last three months, giving the project a single-person bus factor. The matching user-owned project backing provides no organizational handoff evidence.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. For a new package this is a modest transparency and maintenance gap, not evidence of a defect by itself.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency for a package that wraps authentication and HTTP-related dependencies.

Workflow auditcaution

Both workflows use read-only permissions and have no untrusted checkouts or script injection, but all six action references are unpinned. The reported cache-poisoning finding has low confidence, so it is hygiene rather than a severe risk.