visavi/rotor

Usable with caveats: releases are frequent and the repository is active and unarchived, but no maintainers made commits in the last three months. Missing security policy and broad workflow permissions add transparency and automation risk.

Latest v14.6.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Dangerous workflows

One workflow uses pull_request_target, which can be risky when handling untrusted pull requests, but no untrusted checkout or script-injection pattern was detected.

Lifecycle scripts

Three install-time Composer scripts run during installation or project creation. This is expected for a framework-based application but increases install complexity and requires trusting package code during setup.

Project backing

The registry namespace and repository owner match, and the repository is owned by a user rather than an organization. The two registry publishers therefore suggest a relatively small maintainer base, with limited evidence of institutional backup.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern despite the recent release and push timestamps.

Security policy

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities in this public CMS.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Alexander Grigorev

Rotor Community

Direct Dependencies

Dependency	Last Release	Score
visavi/captcha Version ^4.0	—	—
visavi/cleanup Version ^2.2	—	—
mobicms/captcha Version ^5.1	—	—
google/recaptcha Version ~1.3	—	—
laravel/framework Version ^13.0	—	—