redjanym/php-firebase-cloud-messaging

Project backingcaution

The repository is owned by the same individual namespace as the package and is user-backed rather than organization-backed. This is consistent ownership, though it provides limited institutional continuity.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the package released recently, this short-term inactivity is a maintenance concern.

Repo toolingcaution

The repository uses Composer and Make, but no security-scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy. That leaves vulnerability reporting and response expectations undocumented for a package handling Firebase service-account credentials.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but all four action references are unpinned. Unpinned actions weaken build reproducibility and update control.