konekt/pdf-invoice

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tools are reported. The missing scanning is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, so vulnerability-reporting expectations are not documented. This is a limited transparency concern for a maintained library.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or excessive permissions, but both of its two action references are unpinned, leaving avoidable build-reproducibility risk.