oskarstark/env-var-extension

Project backingcaution

The repository is owned by an individual rather than an organization, so there is limited visible institutional backing. This matters more because the registry also lists only one maintainer.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Although the recent release and push show the project is not abandoned, the current activity is quiet.

Security policycaution

The repository has no security policy. For a small Twig extension this is a transparency gap, though it does not by itself indicate abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 13 action references are unpinned, creating a build-reproducibility and action-supply-chain hygiene gap.