flux-se/sylius-eu-vat-plugin

Repo bus factorcaution

All 16 recent commits came from one contributor, leaving maintenance dependent on a single active developer and creating a genuine continuity risk.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear; this is a transparency gap, not evidence of unsafe code.

Workflow auditcaution

All six action references are unpinned, and the audit reported a low-confidence cache-poisoning pattern; there are no untrusted checkouts, script injections, or broad top-level write permissions, so this is a hygiene concern rather than a severe blocker.