opencoreemr/openemr-phpstan-rules
The organization owns the repository, and the release includes tests, a changelog, and release notes. Maintenance is currently concentrated in one contributor, while all 29 workflow actions are unpinned and one workflow inherits secrets. The missing security policy adds a smaller transparency gap.
70%
Total Score
75
100
83
Health Score Breakdown
All recent commits come from one contributor, creating a meaningful continuity risk; organization ownership provides some handoff capacity but no second active contributor is shown.
Only three commits were made in the last three months by one active maintainer, indicating maintenance is present but somewhat thin.
No repository security policy was found, leaving vulnerability-reporting expectations unclear for a package used in development tooling.
All 29 analyzed action references are unpinned, and a high-confidence medium-severity secrets-inherit finding affects the release workflow. There are no untrusted checkouts, script injections, or top-level write permissions, which limits the risk.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Michael A. Smith |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 phpstan/phpstan Version ^2.0 | — | — |
nikic/php-parser Version ^5.0 | — | — |
spaze/phpstan-disallowed-calls Version ^4.0 | — | — |
phpstan/phpstan-deprecation-rules Version ^2.0 | — | — |
Weekly Downloads
Info
- Last Published
- 3 months ago
- Created
- 8 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.