yokai/security-token-bundle

Release historycaution

The package has 20 releases over roughly 10 years, but none in the last two years. The linked repository was pushed more recently and the assessed version has release notes, partly offsetting the stale registry cadence.

Repo commit activitycaution

There were no commits or active maintainers in the last three months. This is a meaningful maintenance concern, although the repository is not archived and was pushed in December 2025.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a security-token bundle, that missing security automation is a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy. That leaves vulnerability reporting and response expectations undocumented, which matters for a package handling security tokens.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkout, or audit findings. However, all five action references are unpinned, leaving build inputs less reproducible and less resistant to upstream changes.