tvdijen/simplesamlphp-module-monitor

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. That is consistent ownership, but it provides less visible organizational continuity if the maintainer becomes unavailable.

Release historycaution

The package has existed since 2017 with 50 releases, but only one release was published in the last 12 months. The recent release and repository push provide some evidence of ongoing maintenance, so this is a mild concern rather than abandonment.

Security policycaution

The repository has no SECURITY.md or other declared security policy. That weakens vulnerability reporting transparency, although it does not by itself make the package unfit.

Workflow auditcaution

All three workflows were analyzed with no detected injection or high-severity findings, but all 23 action references are unpinned and one workflow grants top-level write permissions. The unpinned actions create avoidable build-integrity risk; the broad permission is a smaller concern without an untrusted trigger.