auto1-oss/service-api-components-bundle

Licensecaution

The release includes a LICENSE.md and the repository also has a license file, but the declared MIT license conflicts with the detected Apache-2.0 text. That mismatch reduces licensing clarity despite the presence of licensing evidence.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last 3 months. This is a maintenance caution, though it is partly offset by the release and repository push recorded on the assessment date.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tool was detected. The missing scanner is a modest transparency gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy. That leaves vulnerability reporting and response expectations unclear for a library used in service integrations.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no audited findings or untrusted checkout paths. However, both action references are unpinned, leaving avoidable supply-chain hygiene risk.