wmd/craft-keks-pay

Release historycaution

This is the package's first release, published today, so there is no release cadence or track record yet. That limits confidence in maturity but does not show abandonment.

Repo commit activitycaution

The repository shows no commits in the previous three months, but it was pushed only minutes before this assessment and the package is a first release. This is insufficient history rather than evidence of collapsed maintenance.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For a payment integration, that is a meaningful transparency and maintenance gap, though it is not a severe risk by itself.

Security policycaution

The repository has no security policy, leaving no documented channel or process for reporting vulnerabilities. This is a modest transparency gap for an integration that handles payment callbacks and refunds.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings and scopes permissions at job level, but its one action reference is unpinned. That leaves avoidable build-reproducibility risk without indicating an unsafe workflow.