xchert/util

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That weakens the project's visible security process while other maintenance evidence remains positive.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, not evidence that the package is unsafe.

Workflow auditcaution

Both workflows were analyzed successfully, but all 9 action references are unpinned. The release workflow also grants an app token blanket installation permissions with high-confidence findings, creating a meaningful workflow-hygiene concern.