tacman/graby

Project backingcaution

The package and repository are owned by the same individual account, so there is no organization-backed handoff signal. Other evidence of four active contributors partly offsets that limitation.

Release historycaution

There have been no registry releases in the last 12 months, which is a maintenance concern. However, the repository shows recent commit activity, partly compensating for the stale registry cadence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a minor governance gap for a maintained package.

Workflow auditcaution

Both workflows were fully analyzed with no injection or high-severity findings, but all 16 action references are unpinned. Unpinned actions weaken build reproducibility and supply-chain hygiene without making the release unfit on their own.