rollerworks/password-strength-validator

Workflow auditdanger

All four workflows were analyzed with no untrusted checkout or script-injection trigger, but all 8 action uses are unpinned and a high-confidence template-injection finding was reported in phpstan.yaml. These workflow weaknesses materially reduce supply-chain hygiene.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, a meaningful maintenance concern, though the recent registry releases and long release history provide some compensating evidence.

Repo toolingcaution

The project uses Composer and Make, but no security scanning tools were detected, leaving repository security hygiene less mature.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency for a package that validates passwords.

Version stabilitycaution

The assessed release is not marked as a prerelease and recent prereleases represent only 20% of releases, supporting stability, although the reported latest version is older than the assessed release and creates some version-data ambiguity.