fleetbase/ledger-api

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear for a package that handles accounting, payments, and wallets.

Version stabilitycaution

Version 0.0.12 is not a stable-major release, so its API may still change, but it is not marked prerelease and recent releases have not used prerelease versions.

Workflow auditcaution

The audit completed all five workflows, but 16 of 17 action references are unpinned; high-confidence secrets inheritance was also reported, and trusted-publishing findings indicate long-lived registry-token usage. The lack of top-level permissions is not itself a concern because some workflows use job-level or read-only permissions.