Release notes, licensing, and organizational backing provide useful transparency. Pin the single workflow action and broaden recent contribution beyond one maintainer where possible.
76%
Total Score
88
100
88
100
All seven recent commits came from one contributor, creating a real continuity risk. Symfony organization backing partly compensates because maintenance can be handed off within the project.
Composer build tooling is present, but no repository security-scanning tool was detected, leaving a modest transparency and hygiene gap.
v0.13.0 is not a prerelease, but the package remains below a stable major version, so compatibility expectations are somewhat lower.
The single workflow passed the audit with no findings, no untrusted checkout, and no script injection; however, its one action use is unpinned, which weakens build reproducibility.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
symfony/uid Version ^7.3|^8.0 | — | — |
symfony/ai-store Version ^0.13 | — | — |
symfony/ai-platform Version ^0.13 | — | — |
symfony/http-client Version ^7.3|^8.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.