thewunder/croute

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The recent release partly offsets this, but the lack of current development activity is a maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a transparency and hygiene gap, not evidence that the release is unsafe.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and disclosure expectations unclear.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no reported audit findings or untrusted checkout paths. However, all 3 of its 3 action references are unpinned, creating a workflow supply-chain hygiene gap.