signdeck/veil

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last three months. Although recent pull requests and a recent push show some activity, the measured commit window indicates a thin or stalled maintenance pattern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools are configured. This is a transparency and maintenance gap, though it is not severe on its own.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The workflow audit completed cleanly with no high-confidence dangerous findings, no untrusted checkout or script-injection paths, and no broad write permissions. However, both analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.