sanket3dx/phpgo

Maintainerscaution

One individual has registry publish access. Because the project is also backed by a matching personal repository, this is a thin but coherent ownership setup rather than evidence of a missing organization.

Release historycaution

The package has only two releases, both published on the same day, so there is little evidence of sustained maintenance or release discipline.

Repo toolingcaution

The project uses Make and Composer, but no security-scanning tooling was detected. That is a modest transparency and maintenance gap for a native extension handling compiled artifacts.

Security policycaution

The repository has no security policy, leaving no stated process for reporting or handling vulnerabilities in a native PHP and Go extension.

Workflow auditcaution

All four analyzed action references are unpinned, which weakens build reproducibility. The reported cache-poisoning finding has low confidence and is therefore only a hygiene concern, not a severe workflow risk.