reportkit/core

Release historycaution

The package is only 47 days old and has two releases, both published within a few minutes of each other. That is too little history to establish long-term maintenance reliability.

Repo bus factorcaution

All 59 recent commits came from one contributor, leaving maintenance highly dependent on a single person. The repository owner is an individual rather than an organization, so there is no provided organizational backing to offset that concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a modest transparency and maintenance gap rather than a severe risk on its own.

Version stabilitycaution

The assessed version is a beta prerelease and the package has no stable major release, so its API and behavior may still change.

Workflow auditcaution

The audit covered all 19 workflows and found no untrusted checkouts or script-injection sinks, but all 45 action references are unpinned and three high-confidence template-injection findings remain. The low-confidence cache findings are hygiene concerns only.