liip/imagine-bundle

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so package ownership is less explicit; this may reflect a bundle or monorepo naming convention but remains a transparency caution.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool is reported. The missing scanner is a modest transparency gap, not evidence of abandonment.

Security policycaution

No repository security policy is present, leaving vulnerability reporting and response expectations less transparent for a library with broad application use.

Workflow auditcaution

All three workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all 9 action references are unpinned, creating a reproducibility and action-supply-chain hygiene gap.