tinect/altcha-captcha

Registry deprecationdanger

Packagist marks the entire package as abandoned and names frosh/altcha-captcha as its replacement. This is a direct adoption risk even though the source repository remains active.

Repo commit activitycaution

The repository had 6 commits in the last 3 months, so activity has not vanished. All activity came from one active maintainer, which limits the strength of this compensation.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That weakens assurance modestly without proving a maintenance or supply-chain failure.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, but it is secondary to the package's abandonment status.

Workflow auditcaution

Both workflows were analyzed without failed files, dangerous triggers, sinks, or audit findings. All 5 action references are unpinned, which is a workflow hygiene weakness but not a severe risk by itself.