fond-of-oryx/gift-card-api

Release historycaution

Only three releases were published, with none in the past 12 months; the latest registry release was over three years ago. The repository was pushed more recently, which partly offsets but does not remove the release-cadence concern.

Repo toolingcaution

The repository uses Make and Composer build tooling, but no security scanning tools were detected. This is a modest transparency and maintenance gap.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The workflow audit completed cleanly with no untrusted checkouts or script injection findings, but all three analyzed action references are unpinned. The missing top-level permissions block is acceptable on its own and no write-wide token was detected.