onaonbir/oo-subscription

Release historycaution

This is the only release, published about five months ago, so there is not yet enough release history to establish sustained maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. For a package only about five months old, this raises maintenance uncertainty but does not by itself indicate abandonment.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a minor process gap that lowers confidence in ongoing maintenance hygiene.

Security policycaution

The linked repository has no security policy. This is a modest transparency gap for a package handling subscription and payment-related integration, though the absence is not evidence of a security defect.

Workflow auditcaution

Both workflows grant top-level write permissions, and all four analyzed action references are unpinned. No untrusted trigger or workflow sink was found, so this is a workflow-hygiene caution rather than a severe risk.