os2web/os2web_key

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. That modestly limits automated supply-chain and dependency oversight.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, not evidence that the package is unsafe.

Version stabilitycaution

This release is a prerelease, and all recent releases are prereleases, so API or behavior changes may still be expected. The stable major version and recent release activity provide some compensation.

Workflow auditcaution

All 14 analyzed action references are unpinned, creating avoidable build reproducibility and workflow supply-chain exposure. The audit also found a high-confidence template-injection pattern, but without an untrusted trigger or checkout it is a hygiene concern rather than a severe standalone risk.