ibericode/vat-bundle

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The regular release history partly offsets this, but the recent absence of development activity is still a maintenance caution.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected, leaving a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy file, which makes the process for reporting vulnerabilities less clear to dependents.

Workflow auditcaution

Both workflows were analyzed without audit failures or dangerous triggers, but all 4 action references are unpinned. The lack of top-level permissions blocks is acceptable on its own and is not a danger.