invoicexml/zugferd-xrechnung

Release historycaution

The package is only 0 days old and has two releases, with both published within about 9 hours. This leaves little evidence of sustained maintenance or release stability.

Repo commit activitycaution

Only two commits were recorded in the last 3 months, all during the package's first day. This is consistent with a new project but provides no established maintenance record.

Repo toolingcaution

Composer is used for builds, but no security scanning tool was detected. That is a modest transparency gap for a package handling invoice documents and API credentials.

Security policycaution

The repository has no published security policy. This weakens the project's disclosure and response transparency, especially for an API client used with credentials.

Workflow auditcaution

The single workflow was fully analyzed with no detected high-confidence audit findings or untrusted checkouts, but both action references are unpinned. The workflow also lacks a top-level permissions block, which is acceptable on its own.