spatie/crypto

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured, which is a modest maintenance concern. However, the recent release history and repository push provide compensating evidence against treating this as abandonment.

Security policycaution

No repository security policy was found. This is a transparency gap for a cryptography-focused package, although it does not by itself show unsafe maintenance.

Workflow auditcaution

All three workflows were analyzed, with no untrusted checkout or script-injection findings, but one high-confidence finding reports an unpinned container image and all five action references are unpinned. The pull-request trigger has no dangerous sink reported, so this is workflow hygiene rather than a severe dependency risk.