mohammedmanssour/super-simple-dto

Project backingcaution

The repository is owned by the same individual named in the package namespace, so maintenance rests on a user-owned project rather than an organization.

Security policycaution

No security policy was found, which leaves vulnerability reporting guidance less transparent for users of a dependency.

Workflow auditcaution

All four workflows were analyzed, but all nine action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene and supply-chain concerns rather than standalone severe risk.