wtfzdotnet/php-tmdb-api

Repo commit activitycaution

Only two commits were recorded in the last three months, so active development is modest, but the repository has recent pushes and this does not show a complete maintenance collapse.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent; the organization-backed source repository partly reduces that concern.

Repo toolingcaution

Composer and Phing provide build tooling, but no security-scanning tools were detected, leaving a modest supply-chain hygiene gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations less transparent.

Workflow auditcaution

All three workflows were analyzed with no detected injection sinks or high-severity findings, but all 11 action references are unpinned. The absence of a top-level permissions block is acceptable here and is not itself a concern.