rich-id/email-template-bundle

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These are not inherently unsafe, but they increase install-time behavior and supply-chain exposure.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance warning, though the release history shows activity within the past year.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a maintained PHP library, that is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, but it does not by itself indicate abandonment.

Workflow auditcaution

The sole workflow was fully analyzed with no audit findings or untrusted-code sinks, but both analyzed action references are unpinned. The missing top-level permissions block is acceptable on its own, while unpinned actions remain a minor reproducibility and supply-chain concern.