welpie21/cbor.php

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single registry maintainer provides limited visible organizational backing.

Repo commit activitycaution

There were no commits or active maintainers in the preceding three months, which is a maintenance caution, although the recent release and repository push show the project was active around this version.

Repo toolingcaution

The repository uses Composer, but no security scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so the process for reporting and handling vulnerabilities is not documented.

Workflow auditcaution

All eight action references are unpinned, and the audit found high-confidence template-injection patterns in benchmark.yml; however, there are no pull_request_target or workflow_run triggers and no untrusted checkout or script-injection findings, limiting the practical risk.