ipl/web

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest repository hygiene gap.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response.

Version stabilitycaution

This is not a stable major version, but it is not marked as a prerelease and recent releases contain no prereleases, so the maturity concern is limited.

Workflow auditcaution

All three workflows were analyzed, with no untrusted checkouts or script injection and no broad top-level write permissions. However, all four action references are unpinned, and high-confidence secrets-inherit plus ad hoc package installation findings weaken workflow reproducibility and credential hygiene; the low-confidence cache finding is only a minor concern.