jane-php/open-api-common

Repo toolingcaution

The project uses Composer build tooling, but no security-scanning tool was detected; this is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

The single workflow uses a pull_request_target trigger without an untrusted checkout or script injection, but its one action is unpinned and the audit found no top-level permissions block. The unpinned reference is a workflow hygiene risk.