riverside/php-waf

Release historycaution

The package has four releases over about three years, with only one release in the last 12 months and a median interval of about 315 days. This indicates a small, slow-moving project rather than an actively evolving dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the latest release was recent, the lack of ongoing repository activity limits confidence in prompt fixes.

Repo toolingcaution

Composer is used for builds, but no security scanning tools are configured. For a web application firewall, that is a meaningful security-process gap.

Security policycaution

The repository has no security policy. That makes vulnerability reporting and response expectations less transparent for a security-sensitive package.

Workflow auditcaution

The sole workflow was fully analyzed with no audit findings or dangerous triggers, but all three referenced actions are unpinned. Unpinned actions weaken build reproducibility and update safety.