zacksmash/fortify-ui

Clear documentation, a stable release, repository tests, and a small dependency set make integration straightforward. Maintenance has gone quiet for about 15 months, and the workflow audit found a high-confidence unpinned container image. The missing security policy is a smaller transparency gap.

Latest v2.0.2

Packagist

61%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The package and repository are owned by the same individual rather than an organization, so the single registry maintainer reflects a genuinely narrow project backing base. The repository's tests and tooling provide some operational support but do not broaden that base.

Release history

The package has 27 releases since 2020, but none in the last 12 months; the latest release was about 15 months before collection. This indicates a meaningful maintenance slowdown despite a substantial release history.

Repo commit activity

There were no commits and no active maintainers in the three months before collection. Alongside zero releases in the last 12 months, this is evidence of currently inactive maintenance.

Security policy

The repository has no security policy. This is a transparency gap for a package handling authentication-related scaffolding, though the available security tooling provides some compensation.

Workflow audit

Both workflows were fully analyzed with no untrusted checkouts or script injection, and no workflow has top-level write permissions. However, the audit found a high-confidence unpinned container image, while all five action references are unpinned, leaving the build less reproducible and more exposed to upstream changes.