susina/config-builder

Release historycaution

The package has existed for nearly five years with nine releases, but only one release in the last 12 months and a median interval of about four months indicate a modest maintenance pace.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The same-day release and push provide some compensating evidence, but the recent commit silence still warrants caution.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanner is a modest transparency gap rather than evidence of unsafe code.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script injection, and the low-confidence cache-poisoning finding is hygiene only. However, all 20 action references are unpinned, which weakens build reproducibility and supply-chain control.