pietercolpaert/hardf

It has clear licensing, tests, release notes, and a well-matched source repository. Install and update hooks, unpinned workflow actions, and the lack of a security policy leave avoidable trust and maintenance gaps.

Latest 0.6.2

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Lifecycle scripts

Composer post-install and post-update scripts run during dependency operations, adding execution surface beyond ordinary library loading. No provided signal shows that these hooks are necessary or narrowly scoped.

Repo commit activity

There were no commits and no active maintainers in the last three months. The recent release and push partly offset this, but the current lack of development activity is a maintenance caution.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected. This is a transparency and maintenance gap, though it is not evidence of unsafe code by itself.

Security policy

The repository has no security policy, leaving no documented process for reporting and handling vulnerabilities. This matters for a parser library that may process external data.

Workflow audit

Both workflows use read-only permissions and the audit found no untrusted checkouts, injection sinks, or high- or medium-severity findings. However, all 6 action references are unpinned, so their versions can change without a repository commit.