instride/opendxp-data-definitions

Release historycaution

This is a young package, first released 83 days ago, with only one release. That limits evidence of long-term maintenance and release stability.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning reduces assurance for a package with runtime dependencies.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

All 12 action references are unpinned, and the static-analysis workflow combines pull_request_target with an untrusted checkout; this creates a meaningful workflow supply-chain and execution risk. The audit completed successfully and found no additional high-confidence findings.