twentytwo-labs/api-service-feature-flag

Release historycaution

The package is about two years old but has only three releases, with one release in the last 12 months and a median interval of nearly one year. This suggests a slow maintenance cadence, though it is not abandonment by itself.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing sparse recent development activity. The recent package release provides some evidence of ongoing maintenance but does not fully offset the thin activity.

Repo toolingcaution

The project uses Composer build tooling, but no security scanning tools were detected. This is a modest transparency gap rather than a severe maintenance concern.

Security policycaution

The repository has no security policy, which leaves vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all six referenced actions are unpinned, so workflow dependencies can change unexpectedly; the lack of top-level permissions is acceptable on its own.