spatie/craft-ray

Repo commit activitycaution

No commits or active maintainers were recorded in the three months before collection. The recent release partly offsets this, but the absence of current development activity still merits monitoring.

Repo toolingcaution

Composer is used for builds, but no security-scanning tools were detected. For a small PHP package this is a hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy file. That weakens vulnerability-reporting transparency for users of a production integration.

Workflow auditcaution

Both workflows were analyzed and no untrusted checkout or script-injection path was found, but all five action references are unpinned and a high-confidence finding reports an unpinned container image. These are supply-chain hygiene weaknesses, not a severe risk on their own.