avalara/avalara_sdk

Repo bus factorcaution

One contributor made all commits in the last 3 months, leaving maintenance dependent on a single active contributor; organization backing provides some handoff capacity but does not remove the concentration.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, indicating very limited recent development activity despite the regular release history.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected; this is a modest transparency gap for a maintained SDK.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All four analyzed action references are unpinned, which weakens build reproducibility. The reported cache-poisoning finding is low-confidence hygiene, while the audit found no untrusted checkout or script-injection sink and no broad top-level write permissions.