roukmoute/phlogger

Release historycaution

The package is less than one day old, with eight releases in that period and a median interval of about 25 minutes. This shows active initial development but provides almost no long-term maintenance evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. For a small new library this is a modest transparency gap, not a standalone severe risk.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, although the package's small scope and other documentation provide some compensation.

Version stabilitycaution

Version v0.1.7 is not a stable major release, so the public API may still change. It is not marked as a prerelease, which partly offsets the concern.

Workflow auditcaution

Both workflows use read-only permissions and have no audited findings, untrusted checkouts, or injection sinks. However, all 8 action references are unpinned, leaving workflow dependencies exposed to moving revisions.