fleetbase/storefront-api

Repo toolingcaution

Composer is used as a build tool, but no security-scanning tooling was detected. That leaves a meaningful maintenance and supply-chain hygiene gap for a package with server-side dependencies.

Security policycaution

No SECURITY.md or equivalent repository security policy was found, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All six workflows were analyzed without untrusted checkouts or script injection, but all 26 action references are unpinned, two workflows inherit secrets, and trusted publishing uses long-lived credentials. These create avoidable workflow-hardening risk.