spotlibs/php-lib

Repo bus factorcaution

One contributor made all three commits in the last three months, creating a concentrated maintenance dependency. Organization ownership provides some handoff capacity but no second active contributor is shown.

Repo commit activitycaution

The repository recorded three commits in the last three months, all from one active maintainer. Recent activity exists, but the pace is modest relative to the package's release cadence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a repository hygiene gap.

Security policycaution

No security policy was detected in the linked repository, reducing transparency about how vulnerabilities should be reported.

Workflow auditcaution

The single workflow uses read-only permissions and has no detected injection or high-severity findings, but all three action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.