vanilo/cloud-sdk

Release historycaution

The package has 9 releases since January 2023, but none in the 12 months before collection; the latest release was over 19 months ago. This materially raises maintenance risk.

Repo commit activitycaution

There were zero commits and zero active maintainers in the three months before collection. Combined with the stale release history, this is a clear abandonment concern.

Repo toolingcaution

Composer is used for the build, but no security scanning tools are configured. That weakens project transparency and automated security hygiene.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous audit findings or untrusted checkouts, but all 4 action references are unpinned. This is a supply-chain hygiene gap rather than a severe workflow risk.