yard/samlbase

Release historycaution

Only 2 releases exist, with no release in the last 12 months; the latest registry release was about 19 months ago. This is meaningful evidence of slow release maintenance for a library dependency.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Although it was pushed more recently according to repository status, current observed development activity remains absent.

Repo toolingcaution

Composer and Phing are used for builds, but no security-scanning tooling is present. That is a modest concern for a package handling signing, encryption, and identity assertions.

Security policycaution

No repository security policy was found. For a SAML security library, this is a transparency gap because users benefit from clear vulnerability reporting and response guidance.

Workflow auditcaution

The single analyzed workflow has a high-confidence medium-severity secrets-inherit finding and its only action is unpinned. The workflow has no untrusted checkout or script-injection path, which limits the severity.