roomies/phonable

Lifecycle scriptscaution

The package uses a post-autoload-dump Composer script. This adds install-time behavior, but the provided evidence does not show it is unusually risky or excessive.

Repo commit activitycaution

There were no commits and no active maintainers during the last three months, despite the recent release history; this suggests current development may have paused.

Repo toolingcaution

Composer is used for builds, but no security scanning tools are reported. The missing scanning is a modest transparency and maintenance concern rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and maintenance response.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all five action references are unpinned, which leaves avoidable build-integrity risk.