php-mqtt/client

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although a recent release and push provide some compensating evidence, the short-term development lull lowers confidence in ongoing maintenance.

Security policycaution

No repository security policy was found. For a network-facing MQTT client, the absence of documented vulnerability-reporting guidance is a real transparency gap.

Workflow auditcaution

All two workflows were analyzed with no audit findings or untrusted checkout and script-injection sinks. However, all five action references are unpinned, which weakens build reproducibility, and one workflow grants top-level write access without a corroborating untrusted sink.