phunkie/phetch

Release historycaution

Seven releases arrived within less than one day, with a median interval of about 1.6 hours. This shows active iteration but provides very little evidence of long-term maturity.

Repo bus factorcaution

One contributor made all 24 recent commits, creating a concentrated maintenance risk. The organization-owned repository provides some handoff capacity, so this is not a severe risk on its own.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a modest transparency and hygiene gap for a new library.

Security policycaution

The repository has no security policy, leaving disclosure and response expectations undocumented. This is a hygiene concern rather than evidence of unsafe code.

Workflow auditcaution

The workflow audit completed cleanly with no untrusted checkouts, script injection, or high-severity findings, but all seven action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions weaken build reproducibility.