peterfox/phpstan-toon-formatter

Workflow auditdanger

All four workflows were analyzed, but two high-confidence findings remain: a potentially spoofable bot check and an unpinned container image. All eight action references are unpinned, and three workflows grant top-level write permissions, weakening CI supply-chain hygiene even though no untrusted checkout or script injection was found.

Project backingcaution

The package is maintained under a personal repository rather than organization backing, so its single-publisher and contributor capacity is limited.

Release historycaution

The package has two releases over about eight months, both published within roughly four days of the initial release. This is a small history, so long-term maintenance capacity remains only partly demonstrated.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. For a package released only a few months earlier, this is a meaningful maintenance concern, though it does not by itself prove abandonment.

Security policycaution

The repository has no security policy. That is a transparency gap for reporting vulnerabilities, although Dependabot provides some compensating security automation.