searchkit/searchable

Release historycaution

The package is 141 days old with four releases, but all releases occurred on the same day and there has been no later release. That concentrated launch history provides limited evidence of sustained maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, despite the package being only 141 days old. This is meaningful evidence of stalled maintenance, though not abandonment by itself.

Repo toolingcaution

Composer build tooling is present, but the repository has no detected security scanning tools. That reduces automated coverage for a package intended for application dependencies.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap rather than evidence of an unsafe release.

Workflow auditcaution

The audit analyzed both workflows and found no untrusted checkout or script-injection paths, but all five action references are unpinned and one release workflow has top-level write permissions. These are hygiene concerns; the broad token is not paired with an identified untrusted trigger.