thepublicgood/payfast

Release historycaution

The package is mature at 1990 days old with 17 releases, but only one release appeared in the last 12 months, indicating a slow current cadence.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a meaningful sign of currently limited maintenance capacity despite the recent release.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. This is a transparency and maintenance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The two workflows were fully analyzed with no dangerous triggers or audit findings, but all five action references are unpinned, leaving avoidable workflow supply-chain drift exposure.