setbased/php-audit

Release historycaution

The package has a long history and 22 releases, but it has had no releases in the last 12 months; the latest release was about 15 months ago. This indicates a meaningful maintenance slowdown.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with no release in the last 12 months, this is evidence of currently weak maintenance activity.

Repo toolingcaution

The repository uses Composer and Phing, showing an established build process, but it reports no security-scanning tools. That is a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, leaving no documented process for reporting and handling security issues.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no dangerous audit findings. However, all five action references are unpinned, which weakens build reproducibility and supply-chain hygiene.