sp-express/php-sdk

Release historycaution

The package has existed for about 2 years and 10 months with six releases, but only one release in the last 12 months indicates a modest maintenance cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which is a meaningful maintenance and abandonment concern despite the recent release timestamp.

Security policycaution

No SECURITY.md policy is present. This is a transparency gap for a library handling API credentials, though Psalm and the repository's other tooling provide some compensating process evidence.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkout or injection paths, but all three action references are unpinned and the audit found a high-confidence unpinned container image, weakening build reproducibility and supply-chain hygiene.