zero-to-prod/phpdotenv

Project backingcaution

The repository is owned by a user account rather than an organization, so the single registry maintainer offers limited visible organizational backing.

Release historycaution

This is the only release after about 10 months of package age, so there is little release history from which to judge sustained maintenance.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, indicating currently thin maintenance activity.

Version stabilitycaution

The assessed version is not a prerelease, but it remains on the 0.x major line, which indicates a less mature compatibility commitment.

Workflow auditcaution

All seven analyzed action references are unpinned, and the audit found two high-confidence template-injection findings in annotate.yml. The same workflow also has a script-injection finding, while no untrusted checkout or privileged trigger was reported, so this is a meaningful hygiene and workflow risk rather than a standalone critical defect.