m0d1xd/tap-company-sdk

Project backingcaution

The package and repository are owned by the same individual user, so the project is directly aligned but lacks organization-level maintenance backing.

Release historycaution

The package is only 50 days old and has six releases clustered closely together, showing active early development but limited evidence of long-term stability.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest assurance gap for an SDK handling payment integrations.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and coordinated disclosure less transparent.

Workflow auditcaution

All four workflows were analyzed with no detected audit findings and no untrusted checkout or script-injection sinks. However, all five analyzed action references are unpinned and one workflow grants top-level write access, creating a moderate CI hygiene concern.