utopia-php/config

Security policycaution

The repository has no published security policy, which is a transparency gap for reporting vulnerabilities. The package's active releases and organization backing partly reduce the concern but do not remove it.

Workflow auditcaution

The single workflow has top-level write permissions and one unpinned action reference, creating minor reproducibility and least-privilege concerns. However, the audit found no untrusted checkout, script injection, or other security findings, so this remains hygiene rather than a severe risk.