aura/input

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings, and one scopes permissions at job level. However, all 5 action references are unpinned, weakening build reproducibility and action supply-chain hygiene.